[Bradley Kuhn] I have to be honest I'm really honored to be here
I don't say that to just every conference I care a lot about Debian
This is my 3rd DebConf I've ever been to.
There have been a lot of them so I obviously haven't been to that many
But I was at DebConf1
I just learned today that it was zero based so that it wasn't the first DebConf
which I should have known but didn't for some reason.
I was at the 2nd DebConf by accident somewhat because I was going to
Libre Software Meeting and just happened to
book my flights so that I could be at DebConf as well
I gave a regular track talk at DebConf10 about the GPL v3
because it was in New York City where I was living at the time
Here I'm giving an invited speaker talk or keynote or whatever else it is called here
That really means a lot to me.
I'm a fan of Debian, I'm a user of Debian.
I don't actually consider myself part of the Debian community
because other than filing a few bugs over the years
I haven't contributed all that much to Debian but I've relied on it and used it
and been a fan of it for so long that I really love your project.
So I am really honored to be invited to speak here
and I really believe that Debian is a very special project for a lot of reasons.
First of all, it has thrived for longer than almost any free software project
in existence in a lot of ways. There are top 10 lists of projects that
Debian is certainly on as far as longevity goes, maybe the top 5
It's governance is one of the few democratically elected and
democratically controlled governance processes in free software
Everyone is a fan of talking about this 'benevolent dictator' stuff
which I think is really horrible The fact that somebody would call
themselves a 'self appointed benevolent dictator for life' is really disturbing.
You are democratic.
You elect your leadership.
You have referendums on major issues that everyone can vote on.
That is amazingly rare, impressive and important for free software.
The other thing that really impresses me,
in particular being somebody from the non-profit world,
is that Debian has been staunchly non-commercial for it's entire existence.
Of course I don't mean that Debian can't be used in commercial settings.
DFSG free means that things can be put into commercial products.
What I mean is that the project itself has always been non-commercial,
meaning that the people that work on it are volunteering,
and, even if their employers are paying them to work on it,
they are part of a community and not doing their work inside Debian as
officially part of some commercial activity.
Most free software projects these days are controlled by
some commercial entity or another.
Debian is not.
I was at Debconf1 which was really exciting for me.
I was a young executive director of Free Software.
I showed this picture to Karen Sandler who I work with and said how different I look.
She said I don't look different at all,
but, speaking as the person that looks at that face in the mirror every morning,
there are a lot more lines on my face than there.
That is a smooth looking baby face that I had 14 years ago that I don't have anymore
I was pretty casual back then. I'm not in short trousers any more.
It's hard to see and you can see it in some of the other photos that I was.
Even in this heat like this I haven't worn short trousers in a very long time.
What's that? [bdale heckles]
Bdale, I was thinking about mentioning you and now I have to because you are heckling
me [laughter]. Bdale is the one adult in the room who can dress like
everybody else but I can't pull it off
I respect Bdale that he can. The tie-dye still works for him.
And I stopped wearing t-shirts years ago at conferences
and here I'm sweating in my long sleeves halfway between hacker and suit attire.
And there [in the photo] I'm talking to Martin Michmayer
I'm going to do questions at the end Lars, if that's ok.
I'm not good with questions because I get off topic easy.
I left 17 minutes at the end for questions which Bdale just took 3 of [laughter]
There I'm talking to Martin Michlmayer when I first met him.
A lot of things have changed since I looked at this photo.
But one thing that hasn't changed, you see this face that Martin is making.
He still makes that face at me every time I talk to him, which sort of says like
"You do not know what you are talking about". That hasn't changed, which is good
[laughter]. I'm glad he is laughing in the back there.
Some things have stayed the same. Martin still thinks I'm full of it.
And I probably am, so that's ok. I like people to keep me honest.
Other than jokes, the thing that hasn't really changed since I was first
introduced to the Debian community, in person, back in 2001,
is the ethos of this community is still the same one that I remember
even though a lot of the developers have changed.
I talked to somebody who had never even installed Debian when they were at
DebConf1. I talked to someone who was 12 years old at the time of DebConf1.
I find it impressive that what I call the 'morality of the hobbyist contributor'
still lives strongly in Debian.
The people in Debian want to do what is right for other people -
their users, co-developers, co-contributors.
They also volunteer to do that.
As I said before, that doesn't mean that they aren't being paid to do their work.
It's the classic free software thing: lots of people get paid to write free software.
What I've seen recently, in many free software projects, is that
companies have used that. I think OpenStack is one of the worst examples
of this. To control the project by hiring lots of it's developers.
They have this kindof pull over the project. I think that a lot of people that
work at OpenStack would say they are employers employee first and an
OpenStack contributor second.
I don't know anyone in Debian who would not say 'I am a Debian developer' first
and then I happen to be employed as a second issue.
Debian is their first priority. Their job is their second.
That hobbyist culture of 'my volunteer work matters more to me than
what actually pays me for a living' is the kind of mentality that I am such a
fan of. I try to live that in my own work as well.
I like interacting with the community. I usually find conferences very stressful.
This one I do not find as stressful other than I'm standing in a room with a
huge number of people. Other than that I don't find it stressful
because this is the kind of community that thinks that way.
I think a lot of it has to do with the other structures you have set up around
yourselves. The idea of having charities that you work with
which you have chosen to do a multi charity situation where you have lots
around the world that you can interact with.
One of them was founded by a Debian developer initially.
You reach out to other partnerships or charities as a non-commercial community
That allows you to have an infrastructure that you can rely on that helps
you maintain that community. I'm very glad that you do that.
I used to work for the FSF and am still on the board of directors.
Early in the project Debian was more or less a GNU project for a while.
It was part of the FSF. I know that relationship has never been perfect
sometimes rocky and sometimes better, but the FSF saw this in Debian too
very early on. That it was a really important way to begin the whole
distribution thing of free software and that culture was a match with
FSF's culture.
I know where the issues are and I'm sure John is here to talk about them.
But I think there is a lot of cultural connect between FSF and Debian.
I'm a little obsessed about this quote. I saw it in real time.
I was subscribed to comp.os.minux in Aug of '91 when it was posted
Part of it was that when I started working for the FSF I started thinking about it
and the FSF when I worked there had 7 employees and still has under 20
That's not big.
So I don't think of it as big and I guess strictly speaking,
since the FSF is a very professional organisation, and to take the
strict definition professional means you get paid to do this thing,
you do it for a living - yes, the FSF staff are professionals
in all the ways you might use the word professional,
but I don't think that's what Linus was going for in this quote
I don't think he meant those normal things about professional
I think what he was going for is he was trying to create Linux back when he was humble
Because people forget Linus used to be really humble. Once upon a time.
[laughter]
I don't know... ok. I think some of his early posts were humble
but we can debate that I suppose.
One of the things that Linus understood well was that he wanted to create
a project where individuals collaborated together in their own capacity.
He wanted a hobbyist kind of culture and was interested in that kind of culture.
I think that what he got wrong was not realising how important charities are
to that culture and I think Debian has always got that right.
You've always interacted with charities in good ways.
I think you keep them at arms length, which is OK and reasonable, but
you've always seen the value, always seen the connection between being
a non-commercial hobbyist controlled project, very professional I think, but
still hobbyist controlled in a sense that you are volunteers doing the right things
for everyone in your community.
At the same time reaching out to these charities and letting them help you
get done what you need to get do in the logistical world outside of your project.
What I've seen in other projects that Debian has not suffered from
is the politics of the projects have bifurcated.
There's the technical politics which is the usual arguments about
this technology verses that technology
say, systemd verses upstart, something like that
and that, I think in almost every project still remains under developer control.
People who are developers decide technical decisions like that.
But the political governance in most other projects has been hijacked in my view.
By various different groups, depending on the project
but usually some mix of lawyers or business type people who are somehow
in for profit companies or industry associations,
that have taken over the political governance.
The reason they've succeeded in doing this I think is because most developers
care deeply about the technical politics, but not so much about the other politics.
They want to make those decisions once and leave them alone.
A lot of my work in Conservancy is to help developers make those decisions right once
and then be able to leave them alone without it having bite them later.
I think a lot of projects have faced that situation, where the non technical
politics of their projects are under the control of people who are
not members of the community, not really.
I think that has really happened to Linux.
I think that the Linux non technical politics are out of the hands of
the developers and it's a very sad thing, from my point of view
I think the companies control those politics
and they don't keep developers out entirely, but they gate keep
from letting certain developers into the politics of what's really going on in the
non technical space.
I've met many Linux developers who feel disenfranchised.
It's why Conservancy has a GPL enforcement project for Linux.
Because they've come to us to ask for someone who has a charitable mission
to do the right thing for the public good, as opposed to the what companies want.
I think that's what these charities serve.
If you look at any of these charities that we have out there,
Conservancy, Software in the Public Interest, FSF,
they do things for hobbyist developers that are the morally right thing to do
but are sometimes controversial
that developers actually really need,
maybe sometimes don't want to spend too much time on
because they're more interested in other things,
but companies and trade associations don't need them and in fact
they often oppose them.
As I said, we're doing at Conservancy the GPL enforcement for Linux
because it is not in the business interest of the companies who invest in Linux
to see the GPL enforced.
In many cases they actually oppose it being enforced at all.
Which brings me to copyleft generally.
My last talk to all of you was at DebConf 10,
where I told you about GPL v3 and how wonderful it is and
how much I respected Debian's commitment to copyleft.
Now that's not to say everything in the archive is copyleft, I would guess that
most things in the archive aren't, as it turns out.
But there are many, many important things in Debian's archive that are copylefted
and many Debian meta-projects that you rely on every day as part of your
development that you have chosen to copyleft.
So I see Debian as a strongly connected project to the broader copyleft community
which I am heavily involved in.
Excessively involved in you might say.
The organisation I work for is funding a lawsuit, here in Germany
against VMware for violating the GPL for a very long time and refusing to comply.
Christoph Hellwig is the plaintiff. It is in a Berlin court.
Till Jaeger is his lawyer and you have to read the FAQ.
I am, admittedly, not as comfortable with the German legal system as the US.
I am used to the US where everything is public.
The German legal system doesn't work that way.
I respect the cultural difference and therefore we put what we could in the FAQ
so you could go read it.
So if you were hoping to hear all about the VMware lawsuit in this talk this is
the only slide that covers it, sorry to say.
You can load your browser and look at the FAQ I guess.
The interesting thing that I can talk about is the aftermath in the politics in
the community that I think a lot of people, even people in this room got wrong
about what was going to happen after we sued VMware.
I have myself been a little bit surprised that the response by many for profit
companies (in the back channels, this has not been in press releases, obviously)
has been to attempt to eradicate copyleft entirely, or at the very least
stop its enforcement.
At this point, for anybody who wants to make a strong commitment like Christoph,
like me, to spend a lot of time enforcing GPL, it is an extremely, politically
treacherous decision.
We have people in our GPL enforcement project for Linux at Conservancy who
insist on anonymity because they are terrified it will affect their ability to
get jobs, and other things if they're even heard to be talking to people who do
enforcement.
I think what's happened is that the people who have always been against copyleft
subtly and quietly now see there's some chinks in the armour.
There are very few people still enforcing the copyleft.
The only two organisations doing it as part of a charity are the FSF and
Conservany.
It's a time for the sharks to circle and see if they can finish off the rest.
That's what I think is happening.
Now, this matters to you.
Even if you don't care that much about copyleft, it matters.
Ubuntu was violating your copyrights for two years.
They had a trademark policy that contradicted the GPL.
It's a violation of the GPL.
The Free Software Foundation and Conservacy worked very, very hard for two
years to get it resolved. It's been resolved.
The trademark policy, as it stands - you can read the statements on both
Conservancy and FSF's websites - is in compliance with the GPL.
I'm glad that Canonical eventually did the right thing.
However, you've got to read the fine print.
Because what they've done is they've said "Well, by using this trump clause thing to
comply", it means that all the non copylefted software (from Debian which of
course then ends up in Ubuntu) is then propitiatorized, effectively, when it goes
into Ubuntu, because all these additional restrictions and terms in the trademark
policy that are contradictory to copyleft, the trump clause passes them out for
copyleft so you can't have those contradicting copyleft, but they happily
don't contradict the two clause BSD license, or the Apache software license or
various other licenses.
A lot is being proprietarized, now it's totally permissible by the copyright
license, but I would encourage everyone in the Debian community to think about
how much you like that.
Because your goal is to make everything in main be DFSG free, but when it gets into
Ubuntu main it automatically (if it's not copylefted) falls under this trademark
policy that's unfriendly to free software and I would argue DFSG non-free.
I think we're facing some really tough challenges.
I believe free software has been largely co-opted by for profit companies.
That's why I still say free software and not open source, because I think
source (I actually agree with RMS about this) is a term that allows companies to
take the good parts they want from free software and leave the political stuff
that many of us care about and still be able to exploit it for their own purposes.
Meanwhile, Debian is a hugely important political part of what's happening.
Because Debian is this really important non-commercial project.
Probably the largest non-commercial project of it's kind that's still
extremely relevant in the free software community.
Your long history and your good governance have insulated you from a lot of these
politics that have happened in other projects.
What's happened to OpenStack would never happen to Debian, because you're too
old for it to happen to you.
It's just kinda nice that it works out that way.
There's some usefulness in being old. [laughter]
Eventually the pressure will catch up to you.
Somebody's going to do it.
Canonical just tried it and didn't succeed thanks to the fact that we stopped them
but someone else will come along and try to do it next.
I think it's just a harbinger of things to come at this point and copyleft is going
to matter more and more to Debian as time goes on because it is the thing standing
between these kinds of manoeuvres and free software.
I always see Debian as a key building block of other free software.
People build stuff on top of Debian all the time.
I find in my work investigating GPL violations plenty of times where it's a
Debian system they just took and then gave no source code and moved it into a
product and violated the GPL.
That means that people who are powerful and corrupt will want to control it,
because it's essential and if they could somehow take control of Debian they could
control a lot of the software world.
I think they can't get control of you, because of the way you're organised, but
that doesn't mean they're not going to try.
Now, I think that is so successful because Debian has always been about people.
The decision to make the Debian Developer - and I know it's different know, but
originally the Debian Developer was the pinnacle of how you became part of this
community, you passed your Debian Developer stuff, which I've never been
able to pass, because I'm lame - but I always believe that people oriented
manner of operating was essential to how that worked.
Now since that first DebConf, I admit I've not spent much of my time with developers,
certainly not as much as I would have liked.
I spend most of my time around lawyers and business people in the last 13 or 14 years
and they look at Debian or in fact any free software very differently.
Most of these people look at it not about the people, they see people as basically
fungible - any developer's good as the next, right? From a business person's
perspective.
But the assets that sit there, things like copyrights.
That they look at as the output of Debian,
the value that Debian generates.
There is a certain technical correctness to that, it's like until you write
something down it doesn't exist, kind of thing,
so the fact that Debian generates copyrights as you all are doing your work,
packaging packages, writing documentation, everything that you do.
That's the record of what you did, which is then copyrightable, so there's a
certain logic to this lawyer's way of looking at Debian, so say
"Oh, it's just the assets. There's some trademarks, some copyrights yada yada"
What I think you should all think about in response to that is maybe there's some
value to that, maybe you should leverage the assets we have as a way to fight for
ourselves, fight for good cause of free software.
The one way to look at copyleft is and this is one I like almost the best,
is that it's really just a mechanism to leverage assets, which lots of us agree
shouldn't exist - I'm not a fan of copyright by any means, but you take those
assets that are forced upon you basically by the system we live in and try to
utilize them in some novel way to maximise fairness and goodness and benefit to other
people.
I wrote an essay years ago with Richard Stallman about this, about how the power
to chose a license on software is this inappropriate power that people shouldn't
get. They get it anyway, so the only thing we can do is make a good choice about our
licenses to neutralise the power we should never have been given to start with.
I often talk about this as using the tools of the oppressor against the oppressor.
If we're going to do that, that means we have to look at every tool they use with
regard to copyright.
We've generally just looked at the licensing tool.
The tool of "what license do I put on my software", that's how I'll do it.
I'll put a copyleft license so that I'm defending software freedom by putting
a copyleft licence on my code, but I think Debian could go even further and use these
tools in additional ways to help defend software freedom.
With that, I'd like to announce a thing that Conservancy is doing for Debian.
This was officially put into place in April.
We waited to announce it until my keynote here because we knew I was going to be
keynoting.
It's an agreement that has been signed between the DPL and the Conservancy
to offer the following services to the Debian project,
all of which are optional to all Debian Developers.
It's a programme begun under the Software Freedom Conservancy, and we recognise
that as a member of SPI we asked SPI if it's ok if we did this before we did it
because we wanted to make sure we weren't offending your other charity organisation
in the United States, and they agreed that this was fine.
It permits any Debian Developer who would like to, to optionally, and in a
configurable way, assign any copyrights in their Debian related works to Conservancy
if they would like to.
If they don't want to do that, it also permits them, if they would like, to sign
an enforcement agreement with Conservancy, to ask Conservancy to enforce free
software licenses on behalf of that developer and that's an agreement that
can be cancelled, I'll talk more about that in a minute.
Probably of the most interest to a lot of you because it's going to come up the most
often is Conservancy will provide licensing support and advice on an ongoing
basis for the Debian Project, and I'll talk more later on how we're going to
do that.
The whole reason this exists is because a key Debian contributor came to us and
asked us to do it and we were happy to do it, and I'll talk about who that was in a
few minutes.
First, I felt I have to talk about this, because I've spend a lot of years lately,
in fact the last time I was in Germany, I was here to debate Mark Shuttleworth about
copyright assignment.
The fact that I've just pitched to you that copyright assignment is now available
for Debian Developers I'm sure is probably leaving you to wonder a little bit.
It's certainly true that the kinds of problems that I'm talking about
sometimes come out from the fact that for profit companies come to
free software developers and convince them to assign copyright to that company
or they ask them to sign some heavyweight contributor license
agreement which has the almost legal identical effect of a copyright assignment
The reason they do that is because they want to, usually, make proprietary
versions of those copyrighted works, or otherwise exploit them in some way
that the free software license, that they would have got anyway,
would not allow them to do.
I'm against all that.
I'm opposed to using copyright assignment in that way.
But then when I think about the original motivations of copyleft it always was
using tools that were not totally comfortable with existing at all
against themselves. So why not look at copyright assignment this way:
If you only assign your copyright to charities that take a good strong stand
for software freedom you be able to maximize the benefits of your
copyrights allowing an organization that, say, enforces the GPL or otherwise
trying to do the right things with those copyrights to advance software freedom
you can help that work along by doing that.
The other point I want to make is that the only reason those nefarious uses
of copyright assignment can ever work is because they collect 100%
of copyright.
I think no project should have consolidated copyright at 100%
any more. I think that's an antiquated way of thinking.
I would encourage Debian to have multi copyright held forever which it probably
will. There will never be a single copyright holder of Debian I'm sure.
Even if you just took the parts that Debian developers had contributed,
not all of them are going to sign to one entity.
Even if a few Debian developers assign to Conservancy or many there will still be
a nice diverse copyright base which I think creates a healthy community.
There's a very sad but simply true reason that copyright assignment is important.
This is from the Debian history file. We've lost people in our community.
We will lose more as time goes on.
Most of this community is very young but I'm ageing and we are all ageing at the
same rate, more or less.
You need to think about that question.
What happens if something happens to me.
What happens to my contributions to the community?
What do they do? Where do they go?
I think we should think about that.
I've had to talk to developers heirs on the phone to get licensing problems
fixed. It's one of the most horrible things I've ever had to do on my job.
Think for yourself about: do you want your heirs or people who are in charge
of your copyrights when you pass having to do that.
The other less sad problem is that people forget to take care of things.
They put them off, especially when they are boring and annoying.
So things like copyright enforcement or copyleft enforcement tends
not to happen.
I know from my years and years of experience doing it that
there are constantly hundreds and hundreds of violations all the time.
All of them are urgent, more or less, because they are all really
hurting users.
I don't know about you, but when you have a bug queue
where every single bug is critical, none of them are critical, right?
Because then it's ,like, over, the project is screwed.
That's how GPL enforcement has felt for years and years and years.
While you can think about how having your own copyrights is my privilege
to have and use, it's actually also a burden.
If you care about the license you chose and people are ignoring it broadly all
around the world all the time violating the copyleft (I also see lots of violations
of non-copyleft licenses too) you don't have a mandatory requirement to enforce
but if you care about the license you kinda should be feeling 'gee, I should
take care of that and make sure that the license is respected.