[ale] STORY LINK: Vendor slammed for 'selling' patches

[John Mills]

ALErs -

On Tue, 30 Mar 2004 Sigmascape1 at cs.com wrote:

> Not good.
> 
> Vendor slammed for 'selling' patches 
> http://zdnet.com.com/2100-1105_2-5181825.html?tag=zdfd.newsfeed

<soapbox> As I understand it (&IANAL!!), a vendor delivering software
under the GPL must make available to those to whom the software was
delivered, the sources of the delivered software for the subsequent three
years. This can be done at the time of sale (i.e., including a copy of the
source with the purchased product), by releasing them to a public
repository, or (one supposes) by some other mechanism.

I do not understand this to imply a responsibility to provide either
sources or executables of product upgrades to purchasers of the
pre-upgrade versions of the product. It is also quite usual to release
GPL'd software under a disclaimer of responsibility for product defects:
often it is not guaranteed to do anything, good or bad.

Whatever subsequent responsibilities of vendor to purchaser and vice-versa
should as a matter of good practice be agreed at the time of sale. (Will
anyone who thinks they understand Microsoft's EULA please stand up.  
Anyone??)

We are left with a business decision as to which customers should receive 
updates, patches, phone support, etc. Some companies will give a free 
product upgrade if you purchase the superceeded version within a 
specified interval or the new release's issue. (Borland has offered a 
90-day window in which such upgrades could be purchased for a nominal 
$10.00 -- I don't know if the policy is still in force or which products 
it may cover.)

By the way, are "RealSecure" or "BlackIce" in any way covered by the GPL?  
That would surprise me. If so, any customer receiving the updates could
make them freely available to anyone they chose, and ISS would have no
legal recourse. The GPL _does_ work like that: even if you pay for GPL
released materials, you can give them away (provided _you_ meet the other
release conditions of the GPL).
</soapbox>

Now - a quick grab for the trusty asbestos gloves and welding goggles!

Cheers.
 - John Mills
   john.m.mills at alum.mit.edu