1

One way to get around the GPLv2 is tivoization. Users get the source code and are allowed to modify it but the hardware rejects any modified software thus denying users some rights that were intended in GPLv2.

What successful attack vectors are there against GPLv3 and how to protect against them?

Definition of attack vector: a way of making GPLv3 software available that does not practically give recipients or users the ability to exercise the four freedoms as defined by the FSF.

closed as primarily opinion-based by Bart van Ingen Schenau, vonbrand, curiousdannii, Michael Schumacher, MadHatter Jul 26 '18 at 9:21

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 5
    Much if this depends on what you consider a possible "attack vector." Some people don't consider tivoization an attack vector against the GPLv2, but a legitimate way to use GPL software. In a similar way, would SaaS be a possible attack vector? – Bart van Ingen Schenau Jul 8 '18 at 11:28
  • 1
    I basically understand what you're asking, but I think this could benefit substantially from a formal statement of what you consider an "attack vector". Maybe "a way of making GPL software available that does not practically give recipients or users the ability to exercise the four freedoms"? Is Java-Trap-style free code written for a proprietary environment an attack vector? – apsillers Jul 8 '18 at 13:22
  • 1
    Easiest way to use GPLv3 stuff and not have to distribute source for it would be to use it to create a SaaS platform of some type. Which is why the AGPL exists... – ivanivan Jul 8 '18 at 14:20
  • 1
    The phrasing "attack vectors" is too misleading. It seems you mean an attack against the free software philosophy, but attack vector usually implies security issues. – Brandin Jul 9 '18 at 12:38
  • 1
    @ivanivan GPLv3 only applies when the source is being conveyed, and per the GPLv3 definition of "convey", SaaS is not a conveyance since you can't make a copy of the source or the binary. Thus SaaS is an allowed usage, not an attack vector. – jmarkmurphy Jul 10 '18 at 12:23

Browse other questions tagged or ask your own question.