ftp.acc.umu.se/.../Debians_Central_Role_in_the_Future_of_Software_Freedom.webm

[Bradley Kuhn] I have to be honest
I'm really honored to be here

I don't say that to just every conference
I care a lot about Debian

This is my 3rd DebConf I've ever been to.

There have been a lot of them so I
obviously haven't been to that many

But I was at DebConf1

I just learned today that it was zero
based so that it wasn't the first DebConf

which I should have known but didn't for
some reason.

I was at the 2nd DebConf by accident
somewhat because I was going to

Libre Software Meeting and just
happened to

book my flights so that I could be at
DebConf as well

I gave a regular track talk at DebConf10
about the GPL v3

because it was in New York City where I
was living at the time

Here I'm giving an invited speaker talk or
keynote or whatever else it is called here

That really means a lot to me.

I'm a fan of Debian, I'm a user of Debian.

I don't actually consider myself part of
the Debian community

because other than filing a few bugs
over the years

I haven't contributed all that much to
Debian but I've relied on it and used it

and been a fan of it for so long
that I really love your project.

So I am really honored to be invited to
speak here

and I really believe that Debian is a
very special project for a lot of reasons.

First of all, it has thrived for longer
than almost any free software project

in existence in a lot of ways.
There are top 10 lists of projects that

Debian is certainly on as far as longevity
goes, maybe the top 5

It's governance is one of the few
democratically elected and

democratically controlled
governance processes in free software

Everyone is a fan of talking about this
'benevolent dictator' stuff

which I think is really horrible
The fact that somebody would call

themselves a 'self appointed benevolent
dictator for life' is really disturbing.

You are democratic.

You elect your leadership.

You have referendums on major issues
that everyone can vote on.

That is amazingly rare, impressive
and important for free software.

The other thing that really impresses me,

in particular being somebody from the
non-profit world,

is that Debian has been staunchly
non-commercial for it's entire existence.

Of course I don't mean that Debian
can't be used in commercial settings.

DFSG free means that things can be put
into commercial products.

What I mean is that the project itself has
always been non-commercial,

meaning that the people that work on it
are volunteering,

and, even if their employers are paying
them to work on it,

they are part of a community and not
doing their work inside Debian as

officially part of some
commercial activity.

Most free software projects these days
are controlled by

some commercial entity or another.

Debian is not.

I was at Debconf1 which was really
exciting for me.

I was a young executive director of
Free Software.

I showed this picture to Karen Sandler who
I work with and said how different I look.

She said I don't look different at all,

but, speaking as the person that looks
at that face in the mirror every morning,

there are a lot more lines on my face
than there.

That is a smooth looking baby face that I
had 14 years ago that I don't have anymore

I was pretty casual back then.
I'm not in short trousers any more.

It's hard to see and you can see it in
some of the other photos that I was.

Even in this heat like this I haven't
worn short trousers in a very long time.

What's that? [bdale heckles]

Bdale, I was thinking about mentioning you
and now I have to because you are heckling

me [laughter]. Bdale is the one adult
in the room who can dress like

everybody else but I can't pull it off

I respect Bdale that he can.
The tie-dye still works for him.

And I stopped wearing t-shirts years ago
at conferences

and here I'm sweating in my long sleeves
halfway between hacker and suit attire.

And there [in the photo] I'm talking to
Martin Michmayer

I'm going to do questions at the end Lars,
if that's ok.

I'm not good with questions because I
get off topic easy.

I left 17 minutes at the end for questions
which Bdale just took 3 of [laughter]

There I'm talking to Martin Michlmayer
when I first met him.

A lot of things have changed since I
looked at this photo.

But one thing that hasn't changed,
you see this face that Martin is making.

He still makes that face at me every time
I talk to him, which sort of says like

"You do not know what you are talking
about". That hasn't changed, which is good

[laughter]. I'm glad he is laughing in the
back there.

Some things have stayed the same.
Martin still thinks I'm full of it.

And I probably am, so that's ok.
I like people to keep me honest.

Other than jokes, the thing that hasn't
really changed since I was first

introduced to the Debian community, in
person, back in 2001,

is the ethos of this community is still
the same one that I remember

even though a lot of the developers
have changed.

I talked to somebody who had never
even installed Debian when they were at

DebConf1. I talked to someone who was
12 years old at the time of DebConf1.

I find it impressive that what I call the
'morality of the hobbyist contributor'

still lives strongly in Debian.

The people in Debian want to do what is
right for other people -

their users, co-developers,
co-contributors.

They also volunteer to do that.

As I said before, that doesn't mean that
they aren't being paid to do their work.

It's the classic free software thing: lots
of people get paid to write free software.

What I've seen recently, in many free
software projects, is that

companies have used that. I think
OpenStack is one of the worst examples

of this. To control the project by hiring
lots of it's developers.

They have this kindof pull over the
project. I think that a lot of people that

work at OpenStack would say they are
employers employee first and an

OpenStack contributor second.

I don't know anyone in Debian who would
not say 'I am a Debian developer' first

and then I happen to be employed as a
second issue.

Debian is their first priority.
Their job is their second.

That hobbyist culture of 'my volunteer
work matters more to me than

what actually pays me for a living'
is the kind of mentality that I am such a

fan of. I try to live that in my own work
as well.

I like interacting with the community.
I usually find conferences very stressful.

This one I do not find as stressful
other than I'm standing in a room with a

huge number of people. Other than that
I don't find it stressful

because this is the kind of community
that thinks that way.

I think a lot of it has to do with the
other structures you have set up around

yourselves. The idea of having charities
that you work with

which you have chosen to do a multi
charity situation where you have lots

around the world that you can interact
with.

One of them was founded by a Debian
developer initially.

You reach out to other partnerships or
charities as a non-commercial community

That allows you to have an infrastructure
that you can rely on that helps

you maintain that community.
I'm very glad that you do that.

I used to work for the FSF and am still on
the board of directors.

Early in the project Debian was more or
less a GNU project for a while.

It was part of the FSF. I know that
relationship has never been perfect

sometimes rocky and sometimes better,
but the FSF saw this in Debian too

very early on. That it was a really
important way to begin the whole

distribution thing of free software and
that culture was a match with

FSF's culture.

I know where the issues are and I'm
sure John is here to talk about them.

But I think there is a lot of cultural
connect between FSF and Debian.

I'm a little obsessed about this quote.
I saw it in real time.

I was subscribed to comp.os.minux in Aug
of '91 when it was posted

Part of it was that when I started working
for the FSF I started thinking about it

and the FSF when I worked there had 7
employees and still has under 20

That's not big.

So I don't think of it as big and I guess
strictly speaking,

since the FSF is a very professional
organisation, and to take the

strict definition professional means you
get paid to do this thing,

you do it for a living - yes, the FSF
staff are professionals

in all the ways you might use the word
professional,

but I don't think that's what Linus
was going for in this quote

I don't think he meant those normal things
about professional

I think what he was going for is he was
trying to create Linux back when he was
humble

Because people forget Linus used to be
really humble. Once upon a time.

[laughter]

I don't know... ok. I think some of his
early posts were humble

but we can debate that I suppose.

One of the things that Linus understood
well was that he wanted to create

a project where individuals collaborated
together in their own capacity.

He wanted a hobbyist kind of culture and
was interested in that kind of culture.

I think that what he got wrong was not
realising how important charities are

to that culture and I think Debian has
always got that right.

You've always interacted with charities
in good ways.

I think you keep them at arms length,
which is OK and reasonable, but

you've always seen the value,
always seen the connection between being

a non-commercial hobbyist controlled
project, very professional I think, but

still hobbyist controlled in a sense that
you are volunteers doing the right things

for everyone in your community.

At the same time reaching out to these
charities and letting them help you

get done what you need to get do in the
logistical world outside of your project.

What I've seen in other projects that
Debian has not suffered from

is the politics of the projects have
bifurcated.

There's the technical politics which is
the usual arguments about

this technology verses that technology

say, systemd verses upstart, something
like that

and that, I think in almost every project
still remains under developer control.

People who are developers decide
technical decisions like that.

But the political governance in most other
projects has been hijacked in my view.

By various different groups, depending on
the project

but usually some mix of lawyers or
business type people who are somehow

in for profit companies or industry
associations,

that have taken over the political
governance.

The reason they've succeeded in doing this
I think is because most developers

care deeply about the technical politics,
but not so much about the other politics.

They want to make those decisions once
and leave them alone.

A lot of my work in Conservancy is to help
developers make those decisions right once

and then be able to leave them alone
without it having bite them later.

I think a lot of projects have faced that
situation, where the non technical

politics of their projects are under the
control of people who are

not members of the community, not really.

I think that has really happened to Linux.

I think that the Linux non technical
politics are out of the hands of

the developers and it's a very sad thing,
from my point of view

I think the companies control those
politics

and they don't keep developers out
entirely, but they gate keep

from letting certain developers into the
politics of what's really going on in the

non technical space.

I've met many Linux developers who feel
disenfranchised.

It's why Conservancy has a GPL enforcement
project for Linux.

Because they've come to us to ask for
someone who has a charitable mission

to do the right thing for the public good,
as opposed to the what companies want.

I think that's what these charities serve.

If you look at any of these charities that
we have out there,

Conservancy, Software in the Public
Interest, FSF,

they do things for hobbyist developers
that are the morally right thing to do

but are sometimes controversial

that developers actually really need,

maybe sometimes don't want to spend too
much time on

because they're more interested in other
things,

but companies and trade associations don't
need them and in fact

they often oppose them.

As I said, we're doing at Conservancy the
GPL enforcement for Linux

because it is not in the business interest
of the companies who invest in Linux

to see the GPL enforced.

In many cases they actually oppose it
being enforced at all.

Which brings me to copyleft generally.

My last talk to all of you was at DebConf
10,

where I told you about GPL v3 and how
wonderful it is and

how much I respected Debian's commitment
to copyleft.

Now that's not to say everything in the
archive is copyleft, I would guess that

most things in the archive aren't, as it
turns out.

But there are many, many important things
in Debian's archive that are copylefted

and many Debian meta-projects that you
rely on every day as part of your

development that you have chosen to
copyleft.

So I see Debian as a strongly connected
project to the broader copyleft community

which I am heavily involved in.

Excessively involved in you might say.

The organisation I work for is funding
a lawsuit, here in Germany

against VMware for violating the GPL for
a very long time and refusing to comply.

Christoph Hellwig is the plaintiff. It is
in a Berlin court.

Till Jaeger is his lawyer and you have to
read the FAQ.

I am, admittedly, not as comfortable with
the German legal system as the US.

I am used to the US where everything is
public.

The German legal system doesn't work
that way.

I respect the cultural difference and
therefore we put what we could in the FAQ

so you could go read it.

So if you were hoping to hear all about
the VMware lawsuit in this talk this is

the only slide that covers it, sorry to
say.

You can load your browser and look at the
FAQ I guess.

The interesting thing that I can talk
about is the aftermath in the politics in

the community that I think a lot of
people, even people in this room got wrong

about what was going to happen after we
sued VMware.

I have myself been a little bit surprised
that the response by many for profit

companies (in the back channels, this has
not been in press releases, obviously)

has been to attempt to eradicate copyleft
entirely, or at the very least

stop its enforcement.

At this point, for anybody who wants to
make a strong commitment like Christoph,

like me, to spend a lot of time enforcing
GPL, it is an extremely, politically

treacherous decision.

We have people in our GPL enforcement
project for Linux at Conservancy who

insist on anonymity because they are
terrified it will affect their ability to

get jobs, and other things if they're even
heard to be talking to people who do

enforcement.

I think what's happened is that the people
who have always been against copyleft

subtly and quietly now see there's some
chinks in the armour.

There are very few people still enforcing
the copyleft.

The only two organisations doing it as
part of a charity are the FSF and

Conservany.

It's a time for the sharks to circle and
see if they can finish off the rest.

That's what I think is happening.

Now, this matters to you.

Even if you don't care that much about
copyleft, it matters.

Ubuntu was violating your copyrights for
two years.

They had a trademark policy that
contradicted the GPL.

It's a violation of the GPL.

The Free Software Foundation and
Conservacy worked very, very hard for two

years to get it resolved.
It's been resolved.

The trademark policy, as it stands - you
can read the statements on both

Conservancy and FSF's websites - is in
compliance with the GPL.

I'm glad that Canonical eventually did the
right thing.

However, you've got to read the
fine print.

Because what they've done is they've said
"Well, by using this trump clause thing to

comply", it means that all the non
copylefted software (from Debian which of

course then ends up in Ubuntu) is then
propitiatorized, effectively, when it goes

into Ubuntu, because all these additional
restrictions and terms in the trademark

policy that are contradictory to copyleft,
the trump clause passes them out for

copyleft so you can't have those
contradicting copyleft, but they happily

don't contradict the two clause BSD
license, or the Apache software license or

various other licenses.

A lot is being proprietarized, now it's
totally permissible by the copyright

license, but I would encourage everyone
in the Debian community to think about

how much you like that.

Because your goal is to make everything in
main be DFSG free, but when it gets into

Ubuntu main it automatically (if it's not
copylefted) falls under this trademark

policy that's unfriendly to free software
and I would argue DFSG non-free.

I think we're facing some really tough
challenges.

I believe free software has been largely
co-opted by for profit companies.

That's why I still say free software and
not open source, because I think

source (I actually agree with RMS about
this) is a term that allows companies to

take the good parts they want from free
software and leave the political stuff

that many of us care about and still be
able to exploit it for their own purposes.

Meanwhile, Debian is a hugely important
political part of what's happening.

Because Debian is this really important
non-commercial project.

Probably the largest non-commercial
project of it's kind that's still

extremely relevant in the free software
community.

Your long history and your good governance
have insulated you from a lot of these

politics that have happened in other
projects.

What's happened to OpenStack would never
happen to Debian, because you're too

old for it to happen to you.

It's just kinda nice that it works out
that way.

There's some usefulness in being old.
[laughter]

Eventually the pressure will catch up to
you.

Somebody's going to do it.

Canonical just tried it and didn't succeed
thanks to the fact that we stopped them

but someone else will come along and try
to do it next.

I think it's just a harbinger of things to
come at this point and copyleft is going

to matter more and more to Debian as time
goes on because it is the thing standing

between these kinds of manoeuvres and
free software.

I always see Debian as a key building
block of other free software.

People build stuff on top of Debian all
the time.

I find in my work investigating GPL
violations plenty of times where it's a

Debian system they just took and then
gave no source code and moved it into a

product and violated the GPL.

That means that people who are powerful
and corrupt will want to control it,

because it's essential and if they could
somehow take control of Debian they could

control a lot of the software world.

I think they can't get control of you,
because of the way you're organised, but

that doesn't mean they're not going to
try.

Now, I think that is so successful because
Debian has always been about people.

The decision to make the Debian Developer
- and I know it's different know, but

originally the Debian Developer was the
pinnacle of how you became part of this

community, you passed your Debian
Developer stuff, which I've never been

able to pass, because I'm lame - but I
always believe that people oriented

manner of operating was essential to how
that worked.

Now since that first DebConf, I admit I've
not spent much of my time with developers,

certainly not as much as I would have
liked.

I spend most of my time around lawyers and
business people in the last 13 or 14 years

and they look at Debian or in fact any
free software very differently.

Most of these people look at it not about
the people, they see people as basically

fungible - any developer's good as the
next, right? From a business person's

perspective.

But the assets that sit there, things like
copyrights.

That they look at as the output of Debian,

the value that Debian generates.

There is a certain technical correctness
to that, it's like until you write

something down it doesn't exist, kind of
thing,

so the fact that Debian generates
copyrights as you all are doing your work,

packaging packages, writing documentation,
everything that you do.

That's the record of what you did, which
is then copyrightable, so there's a

certain logic to this lawyer's way of
looking at Debian, so say

"Oh, it's just the assets. There's some
trademarks, some copyrights yada yada"

What I think you should all think about in
response to that is maybe there's some

value to that, maybe you should leverage
the assets we have as a way to fight for

ourselves, fight for good cause of free
software.

The one way to look at copyleft is and
this is one I like almost the best,

is that it's really just a mechanism to
leverage assets, which lots of us agree

shouldn't exist - I'm not a fan of
copyright by any means, but you take those

assets that are forced upon you basically
by the system we live in and try to

utilize them in some novel way to maximise
fairness and goodness and benefit to other

people.

I wrote an essay years ago with Richard
Stallman about this, about how the power

to chose a license on software is this
inappropriate power that people shouldn't

get. They get it anyway, so the only thing
we can do is make a good choice about our

licenses to neutralise the power we should
never have been given to start with.

I often talk about this as using the tools
of the oppressor against the oppressor.

If we're going to do that, that means we
have to look at every tool they use with

regard to copyright.

We've generally just looked at the
licensing tool.

The tool of "what license do I put on my
software", that's how I'll do it.

I'll put a copyleft license so that I'm
defending software freedom by putting

a copyleft licence on my code, but I think
Debian could go even further and use these

tools in additional ways to help defend
software freedom.

With that, I'd like to announce a thing
that Conservancy is doing for Debian.

This was officially put into place in
April.

We waited to announce it until my keynote
here because we knew I was going to be

keynoting.

It's an agreement that has been signed
between the DPL and the Conservancy

to offer the following services to the
Debian project,

all of which are optional to all Debian
Developers.

It's a programme begun under the Software
Freedom Conservancy, and we recognise

that as a member of SPI we asked SPI if
it's ok if we did this before we did it

because we wanted to make sure we weren't
offending your other charity organisation

in the United States, and they agreed that
this was fine.

It permits any Debian Developer who would
like to, to optionally, and in a

configurable way, assign any copyrights in
their Debian related works to Conservancy

if they would like to.

If they don't want to do that, it also
permits them, if they would like, to sign

an enforcement agreement with Conservancy,
to ask Conservancy to enforce free

software licenses on behalf of that
developer and that's an agreement that

can be cancelled, I'll talk more about
that in a minute.

Probably of the most interest to a lot of
you because it's going to come up the most

often is Conservancy will provide
licensing support and advice on an ongoing

basis for the Debian Project, and I'll
talk more later on how we're going to

do that.

The whole reason this exists is because a
key Debian contributor came to us and

asked us to do it and we were happy to do
it, and I'll talk about who that was in a

few minutes.

First, I felt I have to talk about this,
because I've spend a lot of years lately,

in fact the last time I was in Germany, I
was here to debate Mark Shuttleworth about

copyright assignment.

The fact that I've just pitched to you
that copyright assignment is now available

for Debian Developers I'm sure is probably
leaving you to wonder a little bit.

It's certainly true that the kinds of
problems that I'm talking about

sometimes come out from the fact that
for profit companies come to

free software developers and convince
them to assign copyright to that company

or they ask them to sign some
heavyweight contributor license

agreement which has the almost legal
identical effect of a copyright assignment

The reason they do that is because they
want to, usually, make proprietary

versions of those copyrighted works, or
otherwise exploit them in some way

that the free software license, that they
would have got anyway,

would not allow them to do.

I'm against all that.

I'm opposed to using copyright
assignment in that way.

But then when I think about the original
motivations of copyleft it always was

using tools that were not totally
comfortable with existing at all

against themselves. So why not look at
copyright assignment this way:

If you only assign your copyright to
charities that take a good strong stand

for software freedom you be able to
maximize the benefits of your

copyrights allowing an organization that,
say, enforces the GPL or otherwise

trying to do the right things with those
copyrights to advance software freedom

you can help that work along by doing
that.

The other point I want to make is that
the only reason those nefarious uses

of copyright assignment can ever work
is because they collect 100%

of copyright.

I think no project should have
consolidated copyright at 100%

any more. I think that's an antiquated
way of thinking.

I would encourage Debian to have multi
copyright held forever which it probably

will. There will never be a single
copyright holder of Debian I'm sure.

Even if you just took the parts that
Debian developers had contributed,

not all of them are going to sign to
one entity.

Even if a few Debian developers assign
to Conservancy or many there will still be

a nice diverse copyright base which I
think creates a healthy community.

There's a very sad but simply true reason
that copyright assignment is important.

This is from the Debian history file.
We've lost people in our community.

We will lose more as time goes on.

Most of this community is very young but
I'm ageing and we are all ageing at the

same rate, more or less.

You need to think about that question.

What happens if something happens to
me.

What happens to my contributions to
the community?

What do they do?
Where do they go?

I think we should think about that.

I've had to talk to developers heirs on
the phone to get licensing problems

fixed. It's one of the most horrible things
I've ever had to do on my job.

Think for yourself about: do you want
your heirs or people who are in charge

of your copyrights when you pass
having to do that.

The other less sad problem is that
people forget to take care of things.

They put them off, especially when they
are boring and annoying.

So things like copyright enforcement or
copyleft enforcement tends

not to happen.

I know from my years and years of
experience doing it that

there are constantly hundreds and
hundreds of violations all the time.

All of them are urgent, more or less,
because they are all really

hurting users.

I don't know about you, but when
you have a bug queue

where every single bug is critical,
none of them are critical, right?

Because then it's ,like, over, the project
is screwed.

That's how GPL enforcement has felt for
years and years and years.

While you can think about how having
your own copyrights is my privilege

to have and use, it's actually also a
burden.

If you care about the license you chose
and people are ignoring it broadly all

around the world all the time violating
the copyleft (I also see lots of violations

of non-copyleft licenses too) you don't
have a mandatory requirement to enforce

but if you care about the license you
kinda should be feeling 'gee, I should

take care of that and make sure that the
license is respected.

And that's why aggregation might be
for you.

It might be better to aggregate
the copyright somewhere where

people are trying to do the work
of enforcing the copyleft licenses.

I don't think it should be a shame if
you want to be unburdened.

I think that if you feel like

"I care about the license I chose but
I really want somebody else to

handle the copyrights".

There are other people who feel
just like you.

Stefano Zacchiroli was the first to
sign up into the aggregation project.

Yesterday, Zack assigned all of his past
and future contributions to Debian

to the Software Freedom Conservancy.

I can't think of a better endorsement.

I'm honored that Zack is gonna trust
the organization that I work for

with taking care of his copyrights, taking
care of copyleft on his behalf.

He gave me this quote which I'll just
let you read.

Do you want to read it out loud, Zack?

[Zack answers from the audience]

???

I'm not gonna make him come to the mic
and read it.

He's not the only person.

paultag chose the kind of optional, like
"choose what you want to sign".

He assigned a few things from what
he's worked on on Debian

to Conservancy.

I forgot what it was but he can tell you
if you ask him.

He listed them off to me at lunch just
a few minutes ago

and they've already left my brain,
I apologize.

I read them too, and
they left my brain too.

I didn't get much sleep on the plane
???

And he also provided a quote that
he wants to share with you

about how he feels about this new
initiative that we're doing.

And there are others who are talking
about ??? signing

and I was really glad that Clint [Adams]
just agreed at lunch that

he hasn't signed up but he plans to.

He's actually like me, he's very anti-CLA
and anti Copyright Assignment Agreement

but I think the distinction between

assigning to a charity and
assigning to a company

is different, and so I think there is
a lot of value there.

But I also want to talk about the other
things we're doing other than that.

I'm really excited about this program

I know I sound excited because I feel like
the problems it solves are very grave

I sound like like it is urgent in my voice

because I think it's urgent that we deal
with the problems

that this program seeks to address

but we've created a bunch of different
interesting ways to do it.

Conservancy already had this problem
before, where people were like

"Well, I care about the GPL but I don't
want to sign copyright to anyone.

Is there an other way we can get
enforcement done?

Is there an other way we can make sure
copyleft is ???"

And for the ??? project, for a busybox
project, for the GPL ??? project

for Linux developers, we already have
these things called

Enforcement agreements.

What it is is an agreement between
the individual and the organization

that the organization will act
as their enforcement agent

to go out there and ensure that
the copyleft is complied,

the copyleft license of the project
is complied with.

They are cancelable agreements, so
if you decide that Conservancy is

gone crazy and is doing the wrong things,

you cancel with a 30 days notice and then

Conservancy is no longer your enforcement
agent.