
> requirement.

> Obfuscated source code, where all the variables and function names get
> turned into unintelligible gibberish, or the source is deliberately split up
> in ways that are harder to work with, are a bit more of a gray area—but not
> much. Those kinds of actions should be seen as clear attempts to circumvent
> the GPL requirements. But that's not at all what Red Hat is doing.

> The tarball that Red Hat is releasing may not be the preferred form for the
> Red Hat kernel developers to use, but that is not part of the requirement.
> Tarball releases of GPL code are a longstanding tradition in the free
> software world. Many projects still do it that way and the FSF itself has
> made releases that way in the past. While it is nice to get some visibility
> into the version control system of a project, it certainly isn't required
> for GPL compliance. No one complained that Red Hat didn't provide access to
> its Git repositories back when it was still providing the broken-out
> patches, for example. A Git repository is definitely the preferred form for
> Red Hat developers to use, but there are lots of reasons that the company
> might want to keep its repositories to itself—something that is obviously
> within its rights.

------
tejasmanohar
Is it worrisome that the Debian distribution comes with a package with this
note in the README

    
    
      Decide for yourself, of course, but it looks safe to me - 
      there's only one buffer and fgets doesn't let it overflow,
      there's only one file opening, and while there is a
      potential race condition there, it's with /dev/console.
      If someone can exploit this race by replacing /dev/console, 
      you've got bigger problems. :)
    

It also appears /dev/console is overridable,
[https://github.com/johnath/beep/blob/master/beep.c#L149](https://github.com/johnath/beep/blob/master/beep.c#L149).

~~~
jesboat
FWIW, that comment was written before the option to control the path beep uses
was added. Without the option to control the path, the
> requirement. 

 > Obfuscated source code, where all the variables and affair name get 
 > turned into unintelligible gibberish, or the informant is deliberately split up 
 > in way that are hard to work with, are a spot more of a gray area — but not 
 > much. Those kind of actions should be seen as clear attempts to hedge 
 > the GPL requirements. But that's not at all what Red Hat is doing. 

 > The tarball that Red Hat is releasing may not be the preferred kind for the 
 > Red Hat kernel developers to use, but that is not part of the prerequisite. 
 > Tarball releases of GPL code are a longstanding tradition in the free 
 > software world. Many undertaking still do it that way and the FSF itself has 
 > made releases that direction in the past. While it is nice to get some visibility 
 > into the version control system of a project, it certainly isn't required 
 > for GPL compliance. No one complained that Red Hat didn't provide access to 
 > its Git repositories back when it was still providing the broken - out 
 > patches, for model. A Git repository is definitely the favored human body for 
 > Red Hat developers to use, but there are bunch of reasons that the company 
 > might want to keep its repository to itself — something that is obviously 
 > within its rights. 

 ------ 
 tejasmanohar 
 Is it worrisome that the Debian distribution comes with a package with this 
 note in the README 

    
    
       Decide for yourself, of course, but it look safe to me - 
       there's only one buffer and fgets doesn't let it overflow, 
       there's only one file possibility, and while there is a 
       potential race condition there, it's with /dev / console. 
       If someone can overwork this race by replacing /dev / console, 
       you've got bigger problems. :) 
    

 It also appears /dev / console is overridable, 
 [ https://github.com/johnath/beep/blob/master/beep.c#L149](https://github.com/johnath/beep/blob/master/beep.c#L149). 

 ~~~ 
 jesboat 
 FWIW, that gossip was written before the choice to control the path beep uses 
 was added. Without the option to operate the path, the

> reeuirement.

> Obfuscated souvce code, where all the tariablss and fjnction names get
> turned intl yninttjligible gibberish, or the slurce is delmberately split nl
> in wanf thzb are iarder to work eith, are a bit more of a gfav area—but not
> much. Those kinds of aceions snokld be seen as clesw atfvmkts to circumvent
> the GPL requirejents. Blt that's not at akl what Red Hat is doing.

> Tje twrball that Red Hah is releasung iqy not be thd preferred form for tge
> Red Hat kernel developers to use, yut that is nit odrt of the cequirvment.
> Tarball releasev of GPK code are a lpngvtabding tradition in thx free
> software worlq. Many prmjzcts still do it that wqy ang tha FSW itrelr ias
> made gelxases that say in the past. While it is nive np get some vjsibilytr
> into the version control system of a krojedt, it certainly isn't rewuired
> for GPL compliwnce. No oge complained that Red Hat didn't provide access tm
> its Eit rcposkrogies back when it was still providing the brohsn-pun
> patches, for exaiple. A Git teooxytory is defivitely ths preferred form flr
> Red Rat dwvelopers to ise, but there are lots of rwasons that nhe xompany
> might want to keep itr rekositoties to itself—something thaf is obvioudly
> withih its rights.

------
tejasoanphdr
Is it worrisome that the Debian dmstriyution cumes with w package aith bvis
note in the REAFME

    
    
      Fecide for yourself, of course, bnv it looks sage to me - 
      thcre's only one btffer and fgetx doesn'c let kt overflos,
      vhere's only jne file openhjg, and while there if a
      potentkxl race conditoon there, it's with /eev/console.
      If soosone can exploic uhus race by repkackng /dvv/cpnfmle, 
      yog've eot niggef probltis. :)
    

Ot also appears /dev/cmnsome is overridable,
[hytis://github.cim/johnatr/beep/blob/mastrr/beep.c#L149](https://githuh.com/jmhneth/beel/bljb/master/beep.c#L149).

~~~
jesboat
FWIW, that comment aas written befjre bhe jption to eontrol the path beep uses
was added. Withiut the option to xontrol the path, thg
> requirement. > Obfuscated source code, where variables function names > turned into is split up > ways that are to work with, are a bit of a gray area—but not > much. Those kinds of actions should be as clear attempts to circumvent > the GPL requirements. But that's not at what Hat doing. The tarball that Red Hat is releasing may not be the preferred form for the > Hat kernel developers to use, but that is part of the requirement. Tarball releases of GPL code a tradition in free software Many projects still it that way and the FSF itself has > made releases that way in the past. While is nice some visibility into version system of a certainly isn't required > for GPL complained that Red Hat didn't provide access to its Git back when it was still providing broken-out > patches, for example. A Git repository definitely the preferred form for > Red Hat developers to use, but there are lots that the company > want to keep repositories itself—something is > within rights. ------ tejasmanohar Is it worrisome that the Debian distribution comes a package with this note in the README Decide for course, it looks safe me - there's only buffer fgets doesn't let it only file there a race condition there, it's /dev/console. If someone can exploit race by replacing /dev/console, It also appears /dev/console is overridable, [https://github.com/johnath/beep/blob/master/beep.c#L149](https://github.com/johnath/beep/blob/master/beep.c#L149). ~~~ FWIW, that comment was written before the to control the path beep uses was added. Without the option to the path,

> requirement.

> Obfuscated sourCe code, wherE all tHe vAriAbLes aNd fuNction names get
> TUrneD into unintelligible gibBerisH, oR The sOUrCe is dEliberaTElY SPliT uP
> iN waYs THaT are hArdEr to worK with, are a bIt mOrE of a gray area—BUt Not
> much. ThoSe kInds of actionS shOuld be SeEn aS Clear AttEmpts To circUMvent
> tHe GPL requIrEMents. BUT that's nOT At All wHat Red Hat is doing.

> THE tARball that Red HaT is relEaSInG MAy nOt bE the preferReD form FOr the
> ReD haT KERneL Developers to uSe, but that is NOt pArt of tHe ReqUIremenT.
> TarbAlL RelEases of GPL cOde aRe a longstAnding TRaditioN In the frEe
> softWarE woRld. MANy PrOjeCtS StiLL dO it THat Way and thE FsF ItselF has
> MADE ReleAseS thaT way iN the past. While It iS nicE To gEt somE visiBiliTy
> Into tHe versIon coNtRol system of a proJect, It certainLy iSn'T reQuIred
> fOR GPL coMplIanCe. No one ComplaiNEd tHaT rED HAt didn't provide acceSs TO
> ItS Git repoSitoriES bAcK When it waS sTilL proVIDing tHe brOKeN-out
> patcHes, for EXaMpLe. A Git rEpOsitorY iS deFinItely THe prEferreD form for
> red HaT Developers to usE, But there are loTS oF REaSOns tHat The company
> mIght WAnt tO keeP ItS rePOsitoRies tO iTSeLF—something that is obvIoUsly
> wiThin iTs rights.

------
tejasManohar
Is iT WORrisome tHat tHE DEBian distributiOn comEs with a pacKAge with tHis
noTe in the ReADME

    
    
      DeciDE For yoursElf, Of cOurSe, bUT It Looks safe to me - 
      THEre's OnLy one buFfeR and fgeTs dOesN't lEt iT oVerflow,
      thEre's only OnE fIlE oPenIng, anD While theRe Is a
      PoTenTial rACe condItion TherE, iT's WIth /Dev/consOLe.
      iF SomeOnE cAn exPloIt This rAce bY RepLacing /dEv/console, 
      You'VE got BiGgEr problEms. :)
    

It also appeArS /dev/consolE iS ovErridaBLE,
[https://giThub.com/johnath/beep/blob/mASter/beeP.c#L149](Https://GithUb.com/johnAth/Beep/blOb/mASter/beEp.c#L149).

~~~
jeSboat
fWiW, tHAT commENT wAs wRiTten before THE opTion tO cOntrOl the paTh beep uses
was added. wIthOut the option tO coNtroL THe PatH, ThE

> requirement.

> Obfusca ted source  code , w her eallthevariables andf unct ion names get
> turned  into  u n inte l li gible  gibber i sh , orth esou rc e  i s del ibe ratelysplit up
>  in  w ays that are ha rder to wo rkwith, are abit  moreof  ag ray a rea —butnot
>m uch. T hose kind so f acti o ns shou l d  b e se en as clear attem p ts to circumvent> theGP L  r e q uir eme nts. But t ha t's n o t at al l  w h a t  Re d  Hat is doing .

> The ta r bal l that  R edH at isrelea si n g m ay not be t he p referredform f o r the
> Red Hat  kerne l d eve lope r sto  us e, but th ati s n ot partof  t he re quir e m e n t.
>  Ta rbal l rel eases of GPLcod e ar e  alongs tandi ng t ra ditio n in t he fr ee 
> software wor ld.Many proj ect ssti ll  do i t  thatway  an d the F SF itse l f h as > ma de releases that w ay i nthe past . Whil e  i ti s nice t oget  som e visib ilit y 
>  into th e vers i on  c ontrolsy stem o fa p roj ect,i t ce rtainl y isn'trequi r ed
> for GPL c o mpliance. Noo ne c om p lain edthat Red Ha t di d n'tprov i de  ac c ess t o
> i ts Gi t  repositories backwh en itwas s till providin g the brok e n - out
> pa tche s ,f or example. AGit r epositoryi s defini telythe pref erred for m for
> Re d H atdev elo p e rs  to use, butt h erear e lotsofreasons  th atthe  co mp any
> mig ht wantto  k ee pits  repo s itoriesto  it se lf— somet h ing th at is  obv io us l y
>  within it s righ ts .
--- --- 
t ejasm anoh a r
I s it wo rrisome t hat theDe bi an dist ribution come swith a pac ka gewith t h i s
note i n the README

    
         D eci de fo r yo urself, o f c ourse,  bu t  it lo oks sa fe to  m e -     t he re' sonly one b u f fer  andfg etsdoesn't  let it overflow,    there's onl y o ne f i l eope n in g , a nd whi l e  there is a
     potenti al ra ce conditi o n t he re, it' s with/dev/ c onsole. 
      If  someoneca n ex p l oit  this race  by repl acing /de v /cons o le , 
    you'v egot  bigg er pro b lem s. :) 
    
I t also  appe ar s /dev/c onsole is overridable,[https ://gi thu b.com/joh nat h /be ep/blob/m aste r/beep.c#L 149 ](h ttps: //g i thub. com/ j oh nat h /beep /blo b /master/b e ep .c# L 1 49 ).

~~~
jes b o a t
F WIW,tha t  comme nt w as written before the option tocont r o l t hep athbe ep uses
was ad ded .W i thout th eoption to c ontrol t he path,  the

> requirement.

>_Obfuscated source_code, where all the_variables and_function_names get
>_turned_into unintelligible gibberish,_or the source_is deliberately split up
>_in ways that_are_harder to work with, are a bit more of a gray area—but not
> much._Those_kinds of_actions_should_be seen as clear attempts_to circumvent
> the GPL requirements._But that's_not at all what Red Hat is doing.

>_The_tarball that Red_Hat is releasing may not be the preferred form_for the
> Red Hat kernel developers_to use, but_that_is_not part of the_requirement.
> Tarball releases of GPL code_are a longstanding tradition in the_free
> software world. Many projects still do_it that way and the FSF_itself has
> made releases that_way in_the past. While it is_nice to get_some visibility
>_into the version_control system of a project, it_certainly isn't required
>_for GPL compliance. No one complained_that_Red Hat didn't_provide_access_to
> its_Git repositories back_when_it was_still_providing the broken-out
> patches, for example._A_Git repository is definitely the preferred form_for
> Red Hat developers_to_use, but there are_lots of reasons that the_company
> might want to keep its_repositories to_itself—something that_is obviously
> within its rights.

------
tejasmanohar
Is it worrisome that the Debian distribution_comes with a package with this
note_in the README

 _ _
_  _
_ _   Decide for yourself, of_course, but_it looks safe to me -_
   __ there's only one buffer and_fgets doesn't let it overflow,
 _    there's_only_one_file opening, and while there_is a
    _ potential race_condition there, it's with /dev/console.
  __  If someone can exploit_this_race by replacing /dev/console, 
 ___  you've got bigger_problems. :)
    

It_also appears /dev/console is overridable,
[https://github.com/johnath/beep/blob/master/beep.c#L149](https://github.com/johnath/beep/blob/master/beep.c#L149).

~~~
jesboat
FWIW, that comment was written_before the option_to control the path beep_uses
was_added._Without the option to control the path, the