Loading ...
Sorry, an error occurred while loading the content.

License question

Expand Messages
  • Alessandro Vesely
    Hi, I found some interesting filtering recipes maintained in Postfix format, such as http://www.hardwarefreak.com/fqrdns.pcre.txt Since I m not running
    Message 1 of 15 , Feb 27 2:57 AM
    • 0 Attachment
      Hi,
      I found some interesting filtering recipes maintained in Postfix
      format, such as http://www.hardwarefreak.com/fqrdns.pcre.txt

      Since I'm not running Postfix, I think I need to roll my own filter in
      order to run those recipes. At a first glance, smtpd_check.c and
      dict_pcre.c look like good starting points. However, it is not clear
      to me how/if modifications are allowed:

      The derivative work I'd do doesn't seem to be a "Contribution" in the
      sense of the definition given in LICENSE, as it is not going to be
      added to, nor distributed along with Postfix. In addition, PCRE is
      mentioned in HISTORY in 1999, which is the last date in the copyright
      notice imposed by LICENCE for contributions. In fact, only the first
      of those two C sources says "The Secure Mailer license must be
      distributed with this software". And, except strcasecmp.c, no C
      source contains any copyright notice.

      GNU just say that "IBM Public License, Version 1.0 [...] is a free
      software license. Unfortunately, it has a choice of law clause which
      makes it incompatible with the GNU GPL."[1] IANAL, but the latter
      sentence would seem to refer to the last paragraph of the Secure
      Mailer license.

      [1] https://www.gnu.org/licenses/license-list.html#IBMPL

      The software I'd target, Courier-MTA, is GPL-licensed. Some parts of
      the filtering interface I use were derived from it. May a mix those
      sources? If Wietse writes a somewhat affirmative reply, I'll file it
      along with both licenses, and let any idle lawyer loiter over that at
      will.

      Ale
    • Wietse Venema
      ... First, if you don t distribute the code then a lot of the legalese does not apply. Second, I am not a legal expert, but by my reading the IPL (IBM public
      Message 2 of 15 , Feb 27 6:00 AM
      • 0 Attachment
        Alessandro Vesely:
        > Hi,
        > I found some interesting filtering recipes maintained in Postfix
        > format, such as http://www.hardwarefreak.com/fqrdns.pcre.txt
        >
        > Since I'm not running Postfix, I think I need to roll my own filter in
        > order to run those recipes. At a first glance, smtpd_check.c and
        > dict_pcre.c look like good starting points. However, it is not clear
        > to me how/if modifications are allowed:

        First, if you don't distribute the code then a lot of the legalese
        does not apply.

        Second, I am not a legal expert, but by my reading the IPL (IBM
        public license) permits making changes and distributing the resulting
        program as long as one complies with the IPL. I will not comment
        on combining code with IPL and other licenses. Ask a legal expert.

        Besides USING Postfix source code, there are other options:

        - Write a tool that TRANSFORMS fqrdns.pcre.txt so that it can be
        used by a different mail system. That would immediately make
        fqrdns.pcre.txt useful for a lot more people.

        - RE-IMPLEMENT the Postfix functionality. Unlike some projects
        Postfix has documentation that independently says how the software
        must behave. If the software contradicts the documentation, the
        code is fixed to comply.

        Wietse
      • Alessandro Vesely
        Hi Wietse, ... That will only be relevant in case someone else (not me) will want to distribute or modify the derived work, which is not likely. Perhaps I ll
        Message 3 of 15 , Feb 28 3:16 AM
        • 0 Attachment
          Hi Wietse,

          On Thu 27/Feb/2014 15:00:31 +0100 Wietse Venema wrote:
          >
          > Second, I am not a legal expert, but by my reading the IPL (IBM
          > public license) permits making changes and distributing the resulting
          > program as long as one complies with the IPL. I will not comment
          > on combining code with IPL and other licenses. Ask a legal expert.

          That will only be relevant in case someone else (not me) will want to
          distribute or modify the derived work, which is not likely. Perhaps
          I'll ask GNU if they can expand their statement, eventually.

          > Besides USING Postfix source code, there are other options:
          >
          > - Write a tool that TRANSFORMS fqrdns.pcre.txt so that it can be
          > used by a different mail system. That would immediately make
          > fqrdns.pcre.txt useful for a lot more people.

          Hmm... the common ground is looking up RBLs. A quite daunting target.

          > - RE-IMPLEMENT the Postfix functionality. Unlike some projects
          > Postfix has documentation that independently says how the software
          > must behave. If the software contradicts the documentation, the
          > code is fixed to comply.

          Yeah, that was my first thought too. But I'd feel quite silly doing
          so, because Postfix code looks clean and well written. It seems to
          require just some minor reverse engineering and a few changes to be
          ported.

          The true question, beyond legalese, is if you'd welcome such porting
          rather than considering it an unintended use of your publishing the
          sources. I'm unable to tell if that would favor migration between
          Postfix and Courier, and in what direction. It might just slightly
          increase the diffusion of the "Postix format", which I'd consider a
          good thing anyway.

          Regards
          Ale
        • Wietse Venema
          ... If you don t distribute, then a lot of the LICENSE does not even apply. ... The license says what you can do, regardless of my opinion (though it is nice
          Message 4 of 15 , Feb 28 4:20 AM
          • 0 Attachment
            Alessandro Vesely:
            > Hi Wietse,
            >
            > On Thu 27/Feb/2014 15:00:31 +0100 Wietse Venema wrote:
            > >
            > > Second, I am not a legal expert, but by my reading the IPL (IBM
            > > public license) permits making changes and distributing the resulting
            > > program as long as one complies with the IPL. I will not comment
            > > on combining code with IPL and other licenses. Ask a legal expert.
            >
            > That will only be relevant in case someone else (not me) will want to
            > distribute or modify the derived work, which is not likely. Perhaps

            If you don't distribute, then a lot of the LICENSE does not even apply.

            > The true question, beyond legalese, is if you'd welcome such porting
            > rather than considering it an unintended use of your publishing the
            > sources.

            The license says what you can do, regardless of my opinion
            (though it is nice to see some fruits of my labor live on).

            Wietse
          • Alessandro Vesely
            ... Right, but your parenthesized comment makes your stance vividly clear. Thank you. Keep up the good work Ale
            Message 5 of 15 , Mar 3, 2014
            • 0 Attachment
              On Fri 28/Feb/2014 13:20:10 +0100 Wietse Venema wrote:
              > Alessandro Vesely:
              >
              >> The true question, beyond legalese, is if you'd welcome such porting
              >> rather than considering it an unintended use of your publishing the
              >> sources.
              >
              > The license says what you can do, regardless of my opinion
              > (though it is nice to see some fruits of my labor live on).

              Right, but your parenthesized comment makes your stance vividly clear.
              Thank you.

              Keep up the good work
              Ale
            • Stan Hoeppner
              ... Maybe not. It s already been done, 5+ years ago: http://www.corpit.ru/pipermail/rbldnsd/2009q3/001036.html AFAICT the patch was never accepted into
              Message 6 of 15 , Mar 3, 2014
              • 0 Attachment
                On 2/28/2014 5:16 AM, Alessandro Vesely wrote:
                > On Thu 27/Feb/2014 15:00:31 +0100 Wietse Venema wrote:
                ...
                >> Besides USING Postfix source code, there are other options:
                >>
                >> - Write a tool that TRANSFORMS fqrdns.pcre.txt so that it can be
                >> used by a different mail system. That would immediately make
                >> fqrdns.pcre.txt useful for a lot more people.
                >
                > Hmm... the common ground is looking up RBLs. A quite daunting target.

                Maybe not. It's already been done, 5+ years ago:

                http://www.corpit.ru/pipermail/rbldnsd/2009q3/001036.html

                AFAICT the patch was never accepted into vanilla rbldnsd. However,
                Enemies List still uses it to this day on their commercial rbldnsd
                mirrors. The EL implementation does extensive classification and is
                probably more complex than the generic regex implementation I'd guess
                you'd be considering. Simply reading the rbldnsd patch linked in the
                list archive post above may give you a big head start.

                More information available at:
                http://enemieslist.com/

                I don't know if Steven wrote the rbldnsd patch or not but he's the EL
                lead and project creator. I might be able to get you in touch with him
                if you hit any serious roadblocks, should you decide to embark on this.

                --
                Stan
              • Alessandro Vesely
                ... Thank you Stan. That patched rbldnsd seems to be easier to implement, as it would be enough to transform the data, as Wietse said. The old package (.ru
                Message 7 of 15 , Mar 4, 2014
                • 0 Attachment
                  On Mon 03/Mar/2014 14:50:07 +0100 Stan Hoeppner wrote:
                  > On 2/28/2014 5:16 AM, Alessandro Vesely wrote:
                  >> On Thu 27/Feb/2014 15:00:31 +0100 Wietse Venema wrote:
                  >>>
                  >>> - Write a tool that TRANSFORMS fqrdns.pcre.txt so that it can be
                  >>> used by a different mail system. That would immediately make
                  >>> fqrdns.pcre.txt useful for a lot more people.
                  >>
                  >> Hmm... the common ground is looking up RBLs. A quite daunting target.
                  >
                  > Maybe not. It's already been done, 5+ years ago:
                  >
                  > http://www.corpit.ru/pipermail/rbldnsd/2009q3/001036.html
                  >
                  > AFAICT the patch was never accepted into vanilla rbldnsd. However,
                  > Enemies List still uses it to this day on their commercial rbldnsd
                  > mirrors. The EL implementation does extensive classification and is
                  > probably more complex than the generic regex implementation I'd guess
                  > you'd be considering. Simply reading the rbldnsd patch linked in the
                  > list archive post above may give you a big head start.
                  >
                  > More information available at:
                  > http://enemieslist.com/

                  Thank you Stan. That patched rbldnsd seems to be easier to
                  implement, as it would be enough to transform the data, as Wietse
                  said. The old package (.ru link above) contains 59 patterns that may
                  correspond to some of the 1523 REJECT patterns in your file[1]. For
                  example, they have:

                  BRComAjato_01:[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+\.user\.ajato\.com\.br:127.0.0.3:cable

                  instead of

                  /^([12]?[0-9]{1,2}\.){4}user\.ajato\.com\.br$/ REJECT Generic - Please relay via ISP (ajato.com.br)

                  Besides a longer invocation path, rbldnsd doesn't seem to handle
                  conditionals. So the tradeoff is between ease of implementation and
                  efficiency (as usual.)

                  EL talk of "32K rDNS naming conventions" for their licensed dataset.
                  Did you try it?

                  > I don't know if Steven wrote the rbldnsd patch or not but he's the EL
                  > lead and project creator. I might be able to get you in touch with him
                  > if you hit any serious roadblocks, should you decide to embark on this.

                  Steven has a more recent open source package[2] written for Sendmail
                  in m4, which I didn't dare to look at. I'm writing to EL's
                  evaluation address to learn more. (They also market some other
                  intriguing mail features.)

                  Ale

                  [1] http://www.hardwarefreak.com/fqrdns.pcre.txt
                  [2] https://github.com/schampeo/EnemieslistM4
                • Stan Hoeppner
                  ... It s over 100K now. ... I ve never used it. The last Steven and I spoke about it the Postfix interface wasn t sufficiently baked. That was a couple of
                  Message 8 of 15 , Mar 4, 2014
                  • 0 Attachment
                    On 3/4/2014 7:03 AM, Alessandro Vesely wrote:
                    > On Mon 03/Mar/2014 14:50:07 +0100 Stan Hoeppner wrote:
                    >> On 2/28/2014 5:16 AM, Alessandro Vesely wrote:
                    >>> On Thu 27/Feb/2014 15:00:31 +0100 Wietse Venema wrote:
                    >>>>
                    >>>> - Write a tool that TRANSFORMS fqrdns.pcre.txt so that it can be
                    >>>> used by a different mail system. That would immediately make
                    >>>> fqrdns.pcre.txt useful for a lot more people.
                    >>>
                    >>> Hmm... the common ground is looking up RBLs. A quite daunting target.
                    >>
                    >> Maybe not. It's already been done, 5+ years ago:
                    >>
                    >> http://www.corpit.ru/pipermail/rbldnsd/2009q3/001036.html
                    >>
                    >> AFAICT the patch was never accepted into vanilla rbldnsd. However,
                    >> Enemies List still uses it to this day on their commercial rbldnsd
                    >> mirrors. The EL implementation does extensive classification and is
                    >> probably more complex than the generic regex implementation I'd guess
                    >> you'd be considering. Simply reading the rbldnsd patch linked in the
                    >> list archive post above may give you a big head start.
                    >>
                    >> More information available at:
                    >> http://enemieslist.com/
                    >
                    > Thank you Stan. That patched rbldnsd seems to be easier to
                    > implement, as it would be enough to transform the data, as Wietse
                    > said. The old package (.ru link above) contains 59 patterns that may
                    > correspond to some of the 1523 REJECT patterns in your file[1]. For
                    > example, they have:
                    >
                    > BRComAjato_01:[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+\.user\.ajato\.com\.br:127.0.0.3:cable
                    >
                    > instead of
                    >
                    > /^([12]?[0-9]{1,2}\.){4}user\.ajato\.com\.br$/ REJECT Generic - Please relay via ISP (ajato.com.br)
                    >
                    > Besides a longer invocation path, rbldnsd doesn't seem to handle
                    > conditionals. So the tradeoff is between ease of implementation and
                    > efficiency (as usual.)
                    >
                    > EL talk of "32K rDNS naming conventions" for their licensed dataset.

                    It's over 100K now.

                    > Did you try it?

                    I've never used it. The last Steven and I spoke about it the Postfix
                    interface wasn't sufficiently baked. That was a couple of years ago.

                    >> I don't know if Steven wrote the rbldnsd patch or not but he's the EL
                    >> lead and project creator. I might be able to get you in touch with him
                    >> if you hit any serious roadblocks, should you decide to embark on this.
                    >
                    > Steven has a more recent open source package[2] written for Sendmail
                    > in m4, which I didn't dare to look at. I'm writing to EL's
                    > evaluation address to learn more. (They also market some other
                    > intriguing mail features.)

                    TTBOMK the open source packages, Sendmail and qpsmtpd anyway, are the
                    client code which takes action based on the data returned by the rbldnsd
                    server. AFAIK the experimental Postfix and Exim versions use a flat
                    file instead of a DNS query to the rbldnsd server. Steven can tell you
                    more.

                    > [1] http://www.hardwarefreak.com/fqrdns.pcre.txt
                    > [2] https://github.com/schampeo/EnemieslistM4

                    --
                    Stan
                  • Rick Zeman
                    First let me say that I m NOT trying to start any sort of flame war here, and I tried to google to find out the answer before asking. That being said, I just
                    Message 9 of 15 , Apr 20, 2014
                    • 0 Attachment
                      First let me say that I'm NOT trying to start any sort of flame war
                      here, and I tried to google to find out the answer before asking.
                      That being said, I just installed OpenBSD in a VM and ran into this:

                      "Some commonly asked questions about third-party products:

                      Why isn't Postfix included?
                      The license is not free, and thus can not be considered."

                      Not free?
                    • lists@rhsoft.net
                      ... usually you should download the tarball of any software and seek for a document called LICENSE which in case ...
                      Message 10 of 15 , Apr 20, 2014
                      • 0 Attachment
                        Am 21.04.2014 01:43, schrieb Rick Zeman:
                        > First let me say that I'm NOT trying to start any sort of flame war
                        > here, and I tried to google to find out the answer before asking.
                        > That being said, I just installed OpenBSD in a VM and ran into this:
                        >
                        > "Some commonly asked questions about third-party products:
                        >
                        > Why isn't Postfix included?
                        > The license is not free, and thus can not be considered."

                        usually you should download the tarball of any software
                        and seek for a document called "LICENSE" which in case
                        of postfix starts with:

                        >> IBM PUBLIC LICENSE VERSION 1.0 - SECURE MAILER
                        >>
                        >> THE ACCOMPANYING PROGRAM IS PROVIDED UNDER THE TERMS OF THIS IBM PUBLIC
                        >> LICENSE ("AGREEMENT"). ANY USE, REPRODUCTION OR DISTRIBUTION OF THE
                        >> PROGRAM CONSTITUTES RECIPIENT'S ACCEPTANCE OF THIS AGREEMENT.

                        http://en.wikipedia.org/wiki/Postfix_%28software%29
                        Postfix is released under the IBM Public License 1.0 which is a free software licence.

                        http://en.wikipedia.org/wiki/IBM_Public_License

                        This license has also been criticised because of provisions in section 4
                        which require commercial distributors of code covered by this license to
                        indemnify all "upstream" originators for legal costs relating to lawsuits
                        brought about of users of the software. It has been argued that this exposes
                        small distributors (e.g. Linux distributions that happen to sell CDs) to unbounded
                        legal costs, possibly arising from vexatious claims
                        ______________________________________

                        "free" needs a context, the GPL is free, but you are not
                        free to use GPL licesed code, change it, include it in
                        a commercial product and make your product closed source
                      • Rick Zeman
                        ... Yeah, I ve seen the Postfix license text more time than I can count (in every config file, too), and I evenread that wiki page. However the line The IBM
                        Message 11 of 15 , Apr 20, 2014
                        • 0 Attachment
                          On Sun, Apr 20, 2014 at 7:54 PM, lists@... <lists@...> wrote:
                          >
                          >
                          > Am 21.04.2014 01:43, schrieb Rick Zeman:
                          >> First let me say that I'm NOT trying to start any sort of flame war
                          >> here, and I tried to google to find out the answer before asking.
                          >> That being said, I just installed OpenBSD in a VM and ran into this:
                          >>
                          >> "Some commonly asked questions about third-party products:
                          >>
                          >> Why isn't Postfix included?
                          >> The license is not free, and thus can not be considered."
                          >
                          > usually you should download the tarball of any software
                          > and seek for a document called "LICENSE" which in case
                          > of postfix starts with:
                          >
                          >>> IBM PUBLIC LICENSE VERSION 1.0 - SECURE MAILER
                          >>>
                          >>> THE ACCOMPANYING PROGRAM IS PROVIDED UNDER THE TERMS OF THIS IBM PUBLIC
                          >>> LICENSE ("AGREEMENT"). ANY USE, REPRODUCTION OR DISTRIBUTION OF THE
                          >>> PROGRAM CONSTITUTES RECIPIENT'S ACCEPTANCE OF THIS AGREEMENT.
                          >
                          > http://en.wikipedia.org/wiki/Postfix_%28software%29
                          > Postfix is released under the IBM Public License 1.0 which is a free software licence.
                          >
                          > http://en.wikipedia.org/wiki/IBM_Public_License
                          >
                          > This license has also been criticised because of provisions in section 4
                          > which require commercial distributors of code covered by this license to
                          > indemnify all "upstream" originators for legal costs relating to lawsuits
                          > brought about of users of the software. It has been argued that this exposes
                          > small distributors (e.g. Linux distributions that happen to sell CDs) to unbounded
                          > legal costs, possibly arising from vexatious claims
                          > ______________________________________
                          >
                          > "free" needs a context, the GPL is free, but you are not
                          > free to use GPL licesed code, change it, include it in
                          > a commercial product and make your product closed source

                          Yeah, I've seen the Postfix license text more time than I can count
                          (in every config file, too), and I evenread that wiki page.
                          However the line

                          The IBM Public License (IPL) is a free software / open-source software
                          license written and sometimes used by IBM. It is approved by the Open
                          Source Initiative and is described as a "free software license" by the
                          Free Software Foundation(FSF).

                          to me reaffirmed not contravened Postfix's "freeness" since I would
                          think that something called the "Free Software Foundation" might be
                          considered somewhat authoritative?
                        • Viktor Dukhovni
                          ... Not free enough for Theo. More detailed answers in archives of OpenBSD mailing lists. -- Viktor.
                          Message 12 of 15 , Apr 20, 2014
                          • 0 Attachment
                            On Sun, Apr 20, 2014 at 07:43:35PM -0400, Rick Zeman wrote:

                            > "Some commonly asked questions about third-party products:
                            >
                            > Why isn't Postfix included?
                            > The license is not free, and thus can not be considered."
                            >
                            > Not free?

                            Not free enough for Theo. More detailed answers in archives of
                            OpenBSD mailing lists.

                            --
                            Viktor.
                          • lists@rhsoft.net
                            ... again: you need to look at the context it depends *what* someone tends to do with whatever software under whatever license BSD: copyleft, do whatever you
                            Message 13 of 15 , Apr 20, 2014
                            • 0 Attachment
                              Am 21.04.2014 02:05, schrieb Rick Zeman:
                              >> "free" needs a context, the GPL is free, but you are not
                              >> free to use GPL licesed code, change it, include it in
                              >> a commercial product and make your product closed source
                              >
                              > Yeah, I've seen the Postfix license text more time than I can count
                              > (in every config file, too), and I evenread that wiki page.
                              > However the line
                              >
                              > The IBM Public License (IPL) is a free software / open-source software
                              > license written and sometimes used by IBM. It is approved by the Open
                              > Source Initiative and is described as a "free software license" by the
                              > Free Software Foundation(FSF).
                              >
                              > to me reaffirmed not contravened Postfix's "freeness" since I would
                              > think that something called the "Free Software Foundation" might be
                              > considered somewhat authoritative?

                              again: you need to look at the context
                              it depends *what* someone tends to do with whatever software under whatever license

                              BSD: copyleft, do whatever you want in any context you can imagine
                              most other licenses: be careful in case of a closed source product
                            • LuKreme
                              ... That statement is a lie based on a religious position and has nothing at all to do with any facts. What the author of that lie means is The license for
                              Message 14 of 15 , Apr 20, 2014
                              • 0 Attachment
                                On 20 Apr 2014, at 17:43 , Rick Zeman <rzeman@...> wrote:
                                > First let me say that I'm NOT trying to start any sort of flame war
                                > here, and I tried to google to find out the answer before asking.
                                > That being said, I just installed OpenBSD in a VM and ran into this:
                                >
                                > "Some commonly asked questions about third-party products:
                                >
                                > Why isn't Postfix included?
                                > The license is not free, and thus can not be considered."
                                >
                                > Not free?

                                That statement is a lie based on a religious position and has nothing at all to do with any facts. What the author of that lie means is "The license for postfix is not good enough for my religious inclinations."

                                --
                                'Now what?' it said. IT'S UP TO YOU. IT'S ALWAYS UP TO YOU. --Maskerade
                              • Wietse Venema
                                ... Different licenses use different definitions of free . The BSD license permits adoption into closed-source commercial products. Copyleft licenses require
                                Message 15 of 15 , Apr 21, 2014
                                • 0 Attachment
                                  LuKreme:
                                  > > "Some commonly asked questions about third-party products:
                                  > >
                                  > > Why isn't Postfix included?
                                  > > The license is not free, and thus can not be considered."
                                  > >
                                  > > Not free?
                                  >
                                  > That statement is a lie based on a religious position and has
                                  > nothing at all to do with any facts. What the author of that lie
                                  > means is "The license for postfix is not good enough for my religious
                                  > inclinations."

                                  Different licenses use different definitions of "free". The BSD
                                  license permits adoption into closed-source commercial products.
                                  Copyleft licenses require that such products be open source.

                                  Wietse
                                Your message has been successfully submitted and would be delivered to recipients shortly.