 How to tell your OSS is ridiculously popular: people aren't 100% sure they _didn't_ embed it, and tack on the software equivalent of "packaged in a facility where peanuts were also present" to the license list. This watch contains software, so statistically probably contains at least traces of curl. 52 comments
@danderson y'know, that worries me more than "may contain curl". You made the thing... you should know if there's curl in there or not! @evana Knowing nothing about how garmin build firmware, my suspicion is it's something like: this is a list of all OSS present in their Yocto source tree, or similar. Rather than track what OSS makes it into which firmware builds for which SKUs, they just make a list of all OSS that gets too close to their build system, and put that one list in all products. But I dunno 🤷  @danderson @evana This is the likely explanation. We did a similar thing for infotainment at an auto company I worked for: we listed the license of everything that was built in Yocto, but some of those (like GCC, bison, meson, autotools, and other build tools) are never shipped in the image, so technically we may not have needed to list them. The source code tarball you can request under the GPL written offer clause also contains those (even if they're not GPL).  @danderson This explanation is plausible. I cannot honestly argument with that. But it says some about the company using such scheme. And it isn't nice for them. So, probably you are right.  @evana @danderson The “yous” that made the thing—engineers—know. The “yous” that decreed the text be put in there—lawyers—don’t. @ankitpati @evana @danderson This, and it's also easier to have a blanket statement than to ask the engineers every time.  @evana What makes you think because they "made the thing" they know what's inside? At many vendors, what they call the "development team" is mostly clicking things together from some "modular system". They have no clue what gets dragged in or, when you tell them, how to get rid of some unwanted dependency ("but we don't use that!"). Telling them "use exclude:group in your build.gradle" overtaxes them (yepp, a real case I had) 🤷♂️ @danderson @IzzyOnDroid @danderson I guess I need to be more clear: I think it's unfortunate that our tools don't automatically record what they put inside. I'm hopeful that the addition of SBOM requirements for federal contracting will help drive improvements in the tooling so that we can get the contents of our software automatically. Right now, I'm hearing that we know everything that goes into the factory, so we assume that all of that goes into the Twinkies that come out. Including the bolts... @evana Oopsie… No offense meant! Wasn't aware you were involved. Still, my "rant" holds its truth unfortunately in far too many places. But I should add that with the current tools it's not always easy to be aware what went it or what dragged in other things (well, one can check the dependency tree in most cases, but does not always remember too). One reason more than one FOSS dev expressed their thanks to the additional checks at the #IzzyOnDroid repo, for example… So: apologies 4 my phrasing! @IzzyOnDroid no problem! The post went a little further than I expected, and I wanted to follow up with how I thought we could genuinely make software better. @evana That's a driving force for me as well. If I might exaggerate a bit, I guess you'll have a hard time looking at just 10 Github repos without finding some issue, issue comment, PR or review by me 🙈 Especially if it's the repo of some Android app. And it's usually a clear win-win. Not being an Android dev, I've learned a lot about that during the discussions – while my reports usually uncovered something the devs were not aware of. Respect from both sides, precious outcome for all :awesome:  @danderson Good idea. We should make a github action that crawl github repos to gather every single MIT licenced projects and generate a text like that. This way you never have to disclose your actual open source usage again!!!  i am allergic to curl and that's why we need these warnings if i have just a little gzipped curl or if i exchange files with someone who just ran curl i can go into a kernel panic shock  @danderson "This software was generated in a datacentre where curl's source is also being digested by ChatGPT."  @danderson Interestingly, they did it with a misidentification of the curl license for another one.
It isn't MIT/X11 but ISC with "and/or" changed into "and", and the no-advertising clause of the X11 license appended.  @danderson
⚠️ this product is known to the state of california to be able to download from a variety of protocols  @danderson this product is known to the State of California to contain chemicals which may invoke curl    @danderson @matthewskelton My favorite ingredient is “may contain one or more of the following:”.  @danderson "This product may contain at least traces of curl" looks like one of those phrases which people need to put on T-shirts or make stickers of.  @danderson I requested Samsung the sources of the opensource software in my fridge. In the bundle (nearly 1 Gb of sources) went pieces of software probably never actually used (the only "smart" capability of my fridge is selecting temperature and detecting open door) but makefiles or info on how the different parts were built together were missing. @danderson I paid for a curl flavored product, I demand some curl in it.  @danderson  @danderson Could you make an uberlicense that includes all the copyrights you are allowed to include, just in case? Be compliant in case you happened to include one of the components. @danderson And I mean not just those used by the vendor but like all the licenses in the world @danderson being close to the field and the culture, this is open source compliance hacks being open source compliance hacks  @danderson I once had peanut butter that wrote in the label there could potentially be traces of peanuts.  @danderson Your watch both does and doesn't contain curl. Neither scenario is exclusively true until you collapse the wavefunction by examining the software. :blobcatscience:  Funny thing, curl is also embed in action cameras… It's literally an anything that has network  @victorhck @danderson thanks, I have a few versions of that already on display at https://daniel.haxx.se/blog/2016/10/03/screenshotted-curl-credits/ @bagder Yup, I see the Garmin Fenix 5 (2017), Forerunner 245 (2019) and Venu Sq (2021). The one in the photo is a Venu 3s (2023) and features exactly the same wording. Not too surprising, the base firmware doesn't seem to change hugely (mostly new display tech and upgraded sensor hardware), and most of the user visible stuff runs in a custom VM. If I had to guess, I would say maybe libcurl is used for the sync-over-wifi feature for bulk downloads like maps and firmware updates. @danderson Definitely good to know because of my curl allergy! I use wget as an alternative.  @danderson Bets that curl runs on more devices than Java's 1 billion devices?   @danderson (to the tune of Sex Bomb) SBOM, SBOM, where's that SBOM ... You can give it to me so I know what's going on. |
Gregory's Server
Boring joke deflator: afaict it's just Garmin's standard wording so that they can splat in all licenses to everything involved in any of their products, rather than have to generate license compliance text specific to individual firmware builds. But also, lol