When I posted about the hwids data I was not expecting to find what I just found today, and honestly, I’m wondering if I’m always looking for stuff under rocks.
My reason to split out the ID databases off their respective utilities (pciutils and usbutils) was simple enough: I didn’t need to deal with the two utilities, both of which are GPL-2, when the database themselves are available under the BSD 3-clauses license; it was just a matter of removing code, and avoiding auditing of projects that we don’t need to rely upon.
The fact that it was still a pet peeve of mine to not have an extra package taking care of it, rather than bundling them, was just an added bonus.
So after creating a silly placeholder which is fine for our needs here, with the blessing of Greg I created a new package, sys-apps/hwids (I wanted to call it hwdata, but we have both gentoo-hwdata and redhat-hwdata that install very different stuff), which has its own repository and with a live ebuild that simply fetches the files out of the respective website. I’m going to update the package weekly, if there are changes, so that we always have a more up-to-date version of it, and we won’t be needing the network cron scripts at all either.
I’ve also updated lshw to support the split package, so that it doesn’t install its own ids files anymore… of course that is only half the work done there, since the lshw package has two more datafiles: oui.txt and manuf.txt. The latter comes out of Wireshark, while the former is downloaded straight from IEEE’s Public OUI registry and that’s where the trouble starts.
The problem is that while you’re free to download the oui.txt file, you won’t find any kind of license on the file itself. I’ve sent a request to IEEE for some clarification on the matter and their answer is a clear “you cannot redistribute that file” (even though Ulrich, while not a lawyer, pointed out that it’s factual information which might not be copyrightable at all — see Threshold of originality for further details.
So why would I care about that single file given that lshw is a minor package by itself, and shouldn’t matter that much? Well, the answer is actually easy to give: bluez also contains a copy of it. And we’re redistributing that for sure, at least in source form. Sabayon is actually distributing binaries of it.
Interestingly enough, neither Debian’s lshw package nor their Bluez one do install the oui.txt file and I wouldn’t be surprised if their source archives have been neutered made Free by removing the distributed copy of the file.
What should we do about this? Unfortunately, that’s one question I don’t have an answer for myself yet, but I guess it should be clear enough that you can’t always assume that what upstream declares to be the case… actually is the case, especially for what concerns licensing. And this is the reason why, even though we don’t have any problem with releasing the source of all the GPL’d packages we have, we’d like to reduce as much as possible the amount of licenses I have to go through.
The solution is pretty simple:1) download oui.txt from IEEE site once a week2) convert it to speech using some text2speak SW3) send that WAV file to another machine, preferably over an analog phone line4) run speech recognition on that machine, producing something_like_oui.txt5) upload and host somewhere
I recall debian’s approach was to use a silly script that fetches the oui file from IEEE, so they are not technically distributing the file. Of course, that approach fails if you don’t have internet access.Disclaimer: I haven’t used debian for a few years now and their approach may be have switched, although a simple-minded google (debian ieee oui) doesn’t yield any development on the IEEE licensing front.
Simply do not distribute/install useless “copyrighted” crap. From changelog.Debian.gz — Ghe Rivero <ghe@debian.org> Fri, 25 May 2007 11:02:42 +0200lshw (02.10-1) unstable; urgency=low * New upstream release. Closes: #405452 * Remove lshw-common package. manuf.txt and oui.txt aren’t used at all, and we now depend on pciutils and usbutils for pci.ids and usb.ids respectively (ubuntu patch)$ strings $(type -P lshw) | grep -i oui$
I admit, I’m not into legal stuff, but…How exactly is it “distributing”, if every person with an HTTP-client of some sort can fetch it and use some search engine to find it?Just call wget or something from the ebuild, than you’re only distributing a tool making it easier to get the file. Requests won’t be from Gentoo associated IPs and nothing is stored on Gentoo owned systems.
While @lshw@ might or might not use @oui.txt@ right now (I haven’t checked the sources back, I remember though it used to use it), installing it for Gentoo is only half the problem. The main issue is that Gentoo mirrors redistribute @lshw@ and @bluez@ in source form, and both contain the @oui.txt@ file, which IEEE tells me is not redistributable.While we could download the file as part of either @pkg_postint@ and/or @pkg_config@, all of this is subordinate to first get rid of the source tarballs, and tell upstream about it …
The situation is a bit more complex, because the AFAIK in the EU legislation there’s the possibility of copyright of a database and that file could be reasonably considered a database of sorts
Yep, it’s definitely a problem, and at an explicit request, IEEE told me they don’t want us to redistribute it….
Flameeyes: Yes, hence why I told you to not distribute useless junk. Anyway, the thing is clearly not copyrightable, as facts are not copyrightable. See Astrolabe, Inc. v. Olson et al. (yeah, the timezone db nonsense) – https://www.eff.org/cases/a…Obviously frivolous litigation in cases like this can even get you into a serious trouble under FRCP Rule 11 (http://www.law.cornell.edu/…
Thanks for investigating all these licensing issues.