If Canonical is in control of the hardware, then of course they can make
sure the owner/user controls the keys. If Canonical does not have control of
the hardware then it is not their problem regardless of whether they are getting
paid by the hardware manufacturer or not.
The only way your hypothetical
situation would play out the way you suggest is if Canonical signed some
ridiculous contract with the OEM (creating an "agency" or a "warranty") that
specifically shifted the burden back onto Canonical. The GPL-3 does not do this
yet Shuttleworth claims it is a GPL-3 issue.
You say:
I
wouldn't put it past Microsoft to fund a vendor to screw up and then fund a
person to complain.
That seems identical to the malicious person
downstream I was talking about yet you claim your scenario is completely
different from mine. The only possible difference I see is that in your
scenario there is some other contract between Canonical and the OEM and it is
that contract, not the GPL-3, which forces Canonical to release their private
keys.
You asked:
But is Canonical "upstream" or merely an
agent of the machine vendor?
As far as the GPL-3 is concerned
Canonical is strictly upstream even if they are getting paid for the software.
Canonical would have to sign some additional contract to put themselves in a
position where actions by the OEM would force Canonical to release their private
key.
If you agree with me that the GPL-3 would not force Canonical to
release their private key due to the actions of someone (such as an OEM)
downstream then say so. If you still believe the GPL-3 could force Canonical to
release their private keys due to actions out of their control taken by the OEM
then please explain how that is different from the examples I gave.
The
relevant question is not whether Canonical can sign a ridiculous contract that
could end up forcing them to release their private keys. Of course they can, but
that has nothing to do with the GPL-3. The relevant question is whether the
GPL-3 itself can put Canonical in a position where they might be forced to
release their private keys.
Your position on the relevant question is
extremely unclear. If it is some other contract that is forcing key disclosure
then you are spreading anti-GPL FUD. If it is not some other contract that is
forcing disclosure then leave all the other contracts out of the discussion and
explain why you think the GPL-3 itself will force people upstream to be
responsible for actions taken by people downstream.
---
Our job is
to remind ourselves that there are more contexts
than the one we’re in now — the one that we think is reality.
-- Alan Kay [ Reply to This | Parent | # ]
| 
