goran.krampe at bluefish.se wrote:
> Matej Kosik <kosik at fiit.stuba.sk> wrote:
> > PS: Why didn't we register Squeak _directly_ in Debian's package repository? (main/contrib/non-free).
> 
> IIRC that was a no, no because of their dislike of the indemnification
> clause.
> But that is just my vague recollection - may be wrong. Lex probably
> knows.
> 

That's the killer reason it is not even in non-free.  There are also
various reasons it is not in main -- e.g., because they don't like the
export clause, and they don't like the font clause -- but who cares
about main versus non-free?

I spent a while arguing with the Debian guys about this on the
debian-legal mailing list (which, as far as I can tell, is the only
place to talk about such things).  The only reason to reject it from
non-free, is that there is a legal risk in doing it.  However, is it a
realistic risk that someone is going to sue Apple over Debian's
involvment with Squeak... when they could have just sued Debian
directly?  And if Apple does get sued -- over an open source program,
that Apple has released for free, and has made no claims express or
implied etc., and that Apple no longer has anything to do with -- if
Apple does get sued, are they really going to pester Debian about it,
even though they have made a self-image of championing open source
software?  And even if they were that nasty, would they be so stupid as
to offer to turn over their defense completely to Debian?  The clause
requires this, and thus I can't imagine Apple ever trying to cash in on
it.  And even if Apple does get sued over a product they have nothing to
do with and that has no warranty express or implied, etc., and even if
Apple is really that nasty *and* that stupid, what is wrong with Debian
saying "yes, we'll defend the case ourselves, thank you". Since Debian
could have been sued directly, doesn't this effectively put them back
where they started?

I AM NOT A LAWYER.  Just to be clear.  However, neither are any of the
people I was arguing with.  Which just makes it triply annoying: they
are bantering about around an obscure legal risk, when they don't know
diddly about law to begin with.


I'm sure Debian already does plenty of things much more legally
dangerous than this.  I mean, what if Netscape sues them over some
obscure clause in the mammoth MPL ?  What about all the questionable
stuff floating around in the Linux kernel sources?  Why aren't they
freaking out about these possibilities?  And who knows where, in the
millions of lines of code they distribute, there might be a patent
violation?

At this point in the discussions, people start pointing out that maybe
Apple will get sued even though Debian did nothing wrong (duh) and Apple
did nothing wrong (duh, because Apple does nothing at all with Squeak,
how could they do anything wrong?).  The answer to this is obvious: if
you start worrying about frivolous lawsuits, you are hosed anyway.  You
may as well stay home and do nothing.  If some awesome lawyer really
tries to sue Debian into oblivion, they are not going to need an obscure
indemnification clause to do it.


Unfortunately, there's no way in Debian's org to get a real ruling on
the matter, and so these packages are living off site still.  If someone
has more time and energy than me, you may want to press ahead on it, by
either quitting your job so that you can spat on debian-legal 40 hours a
week, or by pushing for a general resolution, or by whatever other
approach seems right.  Maybe it would make sense to broach these issues
in general, e.g. how should Debian deal with *realistic* risk as opposed
to *every possible* risk, or e.g., how should Debian deal with
abandonware, where the license *can't* be changed?  Alternatively, maybe
someone should try to bypass debian-legal and get a general resolution
on Squeak.  Or, maybe someone should really get excited and try to
propose a change to Debian's organization so that they actually have
some sort of real decision-making process about what goes in or out.

In my irritated moments, I wish someone had talked to the Squeak list
before making the initial proclamation to debian-legal that there is a
problem.  The first guy who mentioned Squeak to the Debian guys said
basically "I see some problems, and I give up", without mentioning it on
squeak-dev that I ever saw.  If he had come here first, we could have
put together a better analysis and a better argument that Squeak should
be in Debian.  Now, because of the ordering of things, the status quo is
that Squeak is out... and in a sea of people who don't care and can't
agree on anything, the status quo tends to stick around.

In my optimistic moments, I expect the pendelum to swing back
eventually.   For goodness' sake, Debian now rejects the Mozilla Public
License and also the GNU Free Document License (GFDL).  How far will
they go?  They used to be a Linux distribution.... but if they keep this
up, they will not actually *distribute* anything!  There's a good chance
that the general membership of Debian will object when this silliness
reaches some threshold.  When that happens, either the criteria will be
modified to something more reasonable, or people will fork into a more
tolerant distribution.

In the meantime, I have far better things to do with my time than go
around in circles with those guys.  That battle is winable, I believe,
because Debian exists to do things like distribute Squeak.  However, the
energy and time required to convince them of what's in their own good,
is extraordinary and could be better spent elsewhere.


-Lex