Federal Hearing about Rights under GPL

Post Syndicated from Bradley M. Kuhn original http://ebb.org/bkuhn/blog/2022/05/11/vizio-gpl-federal-hearing.html

[ This is
a crosspost
from my professional blog at Software Freedom Conservancy
(SFC). I encourage you
to use
that copy of the post as the canonical linkage for this essay — I
crossposted here merely for posterity and to reach a wider
audience. ]

Possible Opportunity for the Public To Hear Oral Arguments in Key GPL Enforcement Case

In our previous update regarding our copyleft
enforcement lawsuit against Vizio, we talked about how Vizio
“removed” the case to USA federal court (namely, the Central
District of California), and how we filed a motion to “remand”
the case back to state court. While this all seems like minor legal
wrangling early in a case, this very first skirmish in our case goes to the
very heart of the right for software repair for consumers. While it won’t
be a final decision in the case, this motion will be the first indication
whether the federal courts view the GPL as purely a copyright license, or
as a contract, or as both. That question has been central to legal debate
about the GPL for decades, and, thanks to our case, for the first time, a
federal Court will directly consider this question.

Our view (and the view of many attorneys whose opinions we trust) and which is supported by substantial case law, is that the
GPL functions as both a copyright license and a contract, and that third
parties who receive distribution of GPL’d (and LGPL’d) software are
third-party beneficiaries. We’ve done both copyright-based and
contract-based enforcement, and both have their advantages. Contract-based enforcement as a third-party has advantages that are central to the GPL’s policy goals. Consumers are the first to discover violations in the first place. Consumers are the most likely to utilize complete, corresponding source code (CCS) to enhance their use of the products they have purchased. Third-party, contractual based enforcement gives consumers legal authority when they ask companies for access to the source code that should be available to them. In other words, this approach gives consumers the
ability to ask the Court directly for the most
important thing that copyleft assures: a right to receive the
CCS and “the scripts used to control
compilation and installation of the executable”. Indeed, in our suit we have asked only for access to the source code, not for any money.

Our case
now is the first of its kind to adjudicate the third-party beneficiary
contractual theory. We are excited that a federal district Court is poised
to give its first answer to the central question to this endeavor, namely:
“Are the GPL and LGPL merely copyright licenses, and thus
preempted and only subject matter for the US federal courts, or can a
third-party bring a contract claim in state court?” If this
question intrigues you, we encourage you to read our motion
for remand, Vizio’s reply to that motion
and our rebuttal reply.

Most importantly, clear your calendar for this Friday 13 May 2022 at 10:30
US/Pacific! While Judge Staton may chose to rule on this motion strictly
based on those paper filings, the judge has scheduled a hearing for
that date and time. What’s more, anyone in the world can attend this hearing to
listen! Instructions for how to
attend are
found on Judge Staton’s
website0.

While, as FOSS activists, we’re very sad that the Judge has
chosen to use a proprietary videochat platform, we’re glad that
PSTN dial-in
is provided, and we’ll be dialing in and encourage you to do so as well.
Watch our microblog for live updates!

0 Please
take careful note of the warning on the Judge’s website: Recording,
copying, photographing and rebroadcasting of court proceedings is prohibited
by federal law. Remember: you can take as many notes as you like, and
even live blog/microblog what you hear, but take great care to follow the
directives on Judge Staton’s website.

Federal Hearing about Rights under GPL

Post Syndicated from Bradley M. Kuhn original http://ebb.org/bkuhn/blog/2022/05/11/vizio-gpl-federal-hearing.html

[ This is
a crosspost
from my professional blog at Software Freedom Conservancy
(SFC). I encourage you
to use
that copy of the post as the canonical linkage for this essay — I
crossposted here merely for posterity and to reach a wider
audience. ]

Possible Opportunity for the Public To Hear Oral Arguments in Key GPL Enforcement Case

In our previous update regarding our copyleft
enforcement lawsuit against Vizio, we talked about how Vizio
“removed” the case to USA federal court (namely, the Central
District of California), and how we filed a motion to “remand”
the case back to state court. While this all seems like minor legal
wrangling early in a case, this very first skirmish in our case goes to the
very heart of the right for software repair for consumers. While it won’t
be a final decision in the case, this motion will be the first indication
whether the federal courts view the GPL as purely a copyright license, or
as a contract, or as both. That question has been central to legal debate
about the GPL for decades, and, thanks to our case, for the first time, a
federal Court will directly consider this question.

Our view (and the view of many attorneys whose opinions we trust) and which is supported by substantial case law, is that the
GPL functions as both a copyright license and a contract, and that third
parties who receive distribution of GPL’d (and LGPL’d) software are
third-party beneficiaries. We’ve done both copyright-based and
contract-based enforcement, and both have their advantages. Contract-based enforcement as a third-party has advantages that are central to the GPL’s policy goals. Consumers are the first to discover violations in the first place. Consumers are the most likely to utilize complete, corresponding source code (CCS) to enhance their use of the products they have purchased. Third-party, contractual based enforcement gives consumers legal authority when they ask companies for access to the source code that should be available to them. In other words, this approach gives consumers the
ability to ask the Court directly for the most
important thing that copyleft assures: a right to receive the
CCS and “the scripts used to control
compilation and installation of the executable”. Indeed, in our suit we have asked only for access to the source code, not for any money.

Our case
now is the first of its kind to adjudicate the third-party beneficiary
contractual theory. We are excited that a federal district Court is poised
to give its first answer to the central question to this endeavor, namely:
“Are the GPL and LGPL merely copyright licenses, and thus
preempted and only subject matter for the US federal courts, or can a
third-party bring a contract claim in state court?” If this
question intrigues you, we encourage you to read our motion
for remand, Vizio’s reply to that motion
and our rebuttal reply.

Most importantly, clear your calendar for this Friday 13 May 2022 at 10:30
US/Pacific! While Judge Staton may chose to rule on this motion strictly
based on those paper filings, the judge has scheduled a hearing for
that date and time. What’s more, anyone in the world can attend this hearing to
listen! Instructions for how to
attend are
found on Judge Staton’s
website0.

While, as FOSS activists, we’re very sad that the Judge has
chosen to use a proprietary videochat platform, we’re glad that
PSTN dial-in
is provided, and we’ll be dialing in and encourage you to do so as well.
Watch our microblog for live updates!

0 Please
take careful note of the warning on the Judge’s website: Recording,
copying, photographing and rebroadcasting of court proceedings is prohibited
by federal law. Remember: you can take as many notes as you like, and
even live blog/microblog what you hear, but take great care to follow the
directives on Judge Staton’s website.

Federal Hearing about Rights under GPL

Post Syndicated from Bradley M. Kuhn original http://ebb.org/bkuhn/blog/2022/05/11/vizio-gpl-federal-hearing.html

[ This is
a crosspost
from my professional blog at Software Freedom Conservancy
(SFC). I encourage you
to use
that copy of the post as the canonical linkage for this essay — I
crossposted here merely for posterity and to reach a wider
audience. ]

Possible Opportunity for the Public To Hear Oral Arguments in Key GPL Enforcement Case

In our previous update regarding our copyleft
enforcement lawsuit against Vizio, we talked about how Vizio
“removed” the case to USA federal court (namely, the Central
District of California), and how we filed a motion to “remand”
the case back to state court. While this all seems like minor legal
wrangling early in a case, this very first skirmish in our case goes to the
very heart of the right for software repair for consumers. While it won’t
be a final decision in the case, this motion will be the first indication
whether the federal courts view the GPL as purely a copyright license, or
as a contract, or as both. That question has been central to legal debate
about the GPL for decades, and, thanks to our case, for the first time, a
federal Court will directly consider this question.

Our view (and the view of many attorneys whose opinions we trust) and which is supported by substantial case law, is that the
GPL functions as both a copyright license and a contract, and that third
parties who receive distribution of GPL’d (and LGPL’d) software are
third-party beneficiaries. We’ve done both copyright-based and
contract-based enforcement, and both have their advantages. Contract-based enforcement as a third-party has advantages that are central to the GPL’s policy goals. Consumers are the first to discover violations in the first place. Consumers are the most likely to utilize complete, corresponding source code (CCS) to enhance their use of the products they have purchased. Third-party, contractual based enforcement gives consumers legal authority when they ask companies for access to the source code that should be available to them. In other words, this approach gives consumers the
ability to ask the Court directly for the most
important thing that copyleft assures: a right to receive the
CCS and “the scripts used to control
compilation and installation of the executable”. Indeed, in our suit we have asked only for access to the source code, not for any money.

Our case
now is the first of its kind to adjudicate the third-party beneficiary
contractual theory. We are excited that a federal district Court is poised
to give its first answer to the central question to this endeavor, namely:
“Are the GPL and LGPL merely copyright licenses, and thus
preempted and only subject matter for the US federal courts, or can a
third-party bring a contract claim in state court?” If this
question intrigues you, we encourage you to read our motion
for remand, Vizio’s reply to that motion
and our rebuttal reply.

Most importantly, clear your calendar for this Friday 13 May 2022 at 10:30
US/Pacific! While Judge Staton may chose to rule on this motion strictly
based on those paper filings, the judge has scheduled a hearing for
that date and time. What’s more, anyone in the world can attend this hearing to
listen! Instructions for how to
attend are
found on Judge Staton’s
website0.

While, as FOSS activists, we’re very sad that the Judge has
chosen to use a proprietary videochat platform, we’re glad that
PSTN dial-in
is provided, and we’ll be dialing in and encourage you to do so as well.
Watch our microblog for live updates!

0 Please
take careful note of the warning on the Judge’s website: Recording,
copying, photographing and rebroadcasting of court proceedings is prohibited
by federal law. Remember: you can take as many notes as you like, and
even live blog/microblog what you hear, but take great care to follow the
directives on Judge Staton’s website.

Federal Hearing about Rights under GPL

Post Syndicated from Bradley M. Kuhn original http://ebb.org/bkuhn/blog/2022/05/11/vizio-gpl-federal-hearing.html

[ This is
a crosspost
from my professional blog at Software Freedom Conservancy
(SFC). I encourage you
to use
that copy of the post as the canonical linkage for this essay — I
crossposted here merely for posterity and to reach a wider
audience. ]

Possible Opportunity for the Public To Hear Oral Arguments in Key GPL Enforcement Case

In our previous update regarding our copyleft
enforcement lawsuit against Vizio, we talked about how Vizio
“removed” the case to USA federal court (namely, the Central
District of California), and how we filed a motion to “remand”
the case back to state court. While this all seems like minor legal
wrangling early in a case, this very first skirmish in our case goes to the
very heart of the right for software repair for consumers. While it won’t
be a final decision in the case, this motion will be the first indication
whether the federal courts view the GPL as purely a copyright license, or
as a contract, or as both. That question has been central to legal debate
about the GPL for decades, and, thanks to our case, for the first time, a
federal Court will directly consider this question.

Our view (and the view of many attorneys whose opinions we trust) and which is supported by substantial case law, is that the
GPL functions as both a copyright license and a contract, and that third
parties who receive distribution of GPL’d (and LGPL’d) software are
third-party beneficiaries. We’ve done both copyright-based and
contract-based enforcement, and both have their advantages. Contract-based enforcement as a third-party has advantages that are central to the GPL’s policy goals. Consumers are the first to discover violations in the first place. Consumers are the most likely to utilize complete, corresponding source code (CCS) to enhance their use of the products they have purchased. Third-party, contractual based enforcement gives consumers legal authority when they ask companies for access to the source code that should be available to them. In other words, this approach gives consumers the
ability to ask the Court directly for the most
important thing that copyleft assures: a right to receive the
CCS and “the scripts used to control
compilation and installation of the executable”. Indeed, in our suit we have asked only for access to the source code, not for any money.

Our case
now is the first of its kind to adjudicate the third-party beneficiary
contractual theory. We are excited that a federal district Court is poised
to give its first answer to the central question to this endeavor, namely:
“Are the GPL and LGPL merely copyright licenses, and thus
preempted and only subject matter for the US federal courts, or can a
third-party bring a contract claim in state court?” If this
question intrigues you, we encourage you to read our motion
for remand, Vizio’s reply to that motion
and our rebuttal reply.

Most importantly, clear your calendar for this Friday 13 May 2022 at 10:30
US/Pacific! While Judge Staton may chose to rule on this motion strictly
based on those paper filings, the judge has scheduled a hearing for
that date and time. What’s more, anyone in the world can attend this hearing to
listen! Instructions for how to
attend are
found on Judge Staton’s
website0.

While, as FOSS activists, we’re very sad that the Judge has
chosen to use a proprietary videochat platform, we’re glad that
PSTN dial-in
is provided, and we’ll be dialing in and encourage you to do so as well.
Watch our microblog for live updates!

0 Please
take careful note of the warning on the Judge’s website: Recording,
copying, photographing and rebroadcasting of court proceedings is prohibited
by federal law. Remember: you can take as many notes as you like, and
even live blog/microblog what you hear, but take great care to follow the
directives on Judge Staton’s website.

Get kids coding and learning electronics with Raspberry Pi Pico

Post Syndicated from Rebecca Franks original https://www.raspberrypi.org/blog/kids-coding-electronics-raspberry-pi-pico-free-learning-resource/

Since the release of the Raspberry Pi Pico microcontroller in 2021, we have seen people all over the world come up with creative Pico-based inventions.

Raspberry Pi Pico with its inbuilt LED blinking.
The Raspberry Pi Pico microcontroller.

Now, thanks to our brand-new and free ‘Introduction to Raspberry Pi Pico’ learning path, young coders can easily join in and make their own cool Pico projects! This free learning path has six guided projects to help kids to independently develop their coding skills, and their skills in physical computing and electronics.

A girl creates a physical computing project.
Physical computing is a great way to help young people get creative with coding.

In this post, I’ll tell you about Raspberry Pi Pico, what kids can make by following our free ‘Intro to Pico’ path, and what skills they will be learning.

Meet Raspberry Pi Pico

Raspberry Pi Pico is a physical computing device that is low-cost and easy to use. It’s much smaller than any Raspberry Pi computer, and it needs much less power. That’s because it’s not a full computer but instead a microcontroller. That means Pico is a device that you program by writing code on any computer, and then sending that code to Pico via a USB cable.

Raspberry Pi Pico has GPIO pins (like Raspberry Pi computers do). These pins mean it can interact with different types of physical computing components, such as buttons, buzzers, and LEDs.

In the ‘Intro to Raspberry Pi Pico’ path, we’ve designed new digital making projects specifically using Pico. By following the projects in the path, young people learn to make things with different electronic components. They’ll bring to life their own LED fireflies; they’ll make music with a sound machine and dial (a potentiometer); they’ll look after themselves and people around them by making a mood indicator and a heart rate visualiser. To find out more, visit the path, or scroll to the bottom of this post and click on ‘Details about the projects’.

Visit the ‘Intro to Raspberry Pi Pico’ path

The specially designed structure of our learning paths helps kids become confident and independent coders and digital makers. Through this project path, we want to show young people what is possible with Raspberry Pi Pico and inspire them to continue their digital making journey beyond the six projects. Seeing tech creations from our amazing community is super special to us, and we would love to hear about what your young coders have made with Pico. Kids can share their projects in the path gallery, or you can tag us on social media if you post photos!   

alt=""

Learning skills and independence with our project paths 

While young people make all these Raspberry Pi Pico projects, they will learn the skills and independence to make and code their very own, unique creations with a Pico. We have designed our new project paths to help kids become independent digital makers. As they progress through a path, kids gain new skills, practise what they have learnt, and finally write and follow their own project brief. 

Our learning paths help kids develop many of the skills that are important to all coders and digital makers, no matter how much experience they have: 

  • How to turn an idea on paper into a tech creation
  • How to debug a project
  • How to combine new information with what they already know about digital making 

The learning paths also encourage kids to make projects about the things that matter to them.  

Key questions answered

Who is this path for?

We have written the projects in this path with young people around the age of 9 to 13 in mind. 

Programs for Raspberry Pi Pico are written in a text-based language called MicroPython. That means a young person who wants to start the ‘Intro to Pico’ path needs to be familiar with typing on a keyboard.

A young person codes at a Raspberry Pi computer.

If your kid has never coded in a text-based language before, they could complete our free ‘Introduction to Python‘ project path first, but this is not a prerequisite.

What will young people learn?

To help with the programming aspects of the projects, the instructions in the path tell young people about:  

  • Displaying output
  • Arithmetic expressions
  • Importing from a library
  • While loops
  • Nested if statements
  • Defining and calling functions
  • Events
Raspberry Pi Pico attached with jumper wires to a purple LED.
We still get excited by a flashing LED.

One of the great things about this project path is that it helps young people explore physical computing and electronics. In the ‘Intro to Pico’ path, they’ll use:

  • Single-colour LEDs
  • Multi-colour LEDs (so-called RGB LEDs)
  • Buzzers
  • Switches (including switches the kids will make out of craft materials!)
  • Buttons
  • Potentiometers (dials)

How much time is needed to complete the path?

We’ve designed the path to be completed in around six one-hour sessions, with one hour per project. However, the project instructions encourage kids to upgrade their projects and go further if they wish. This means that they might want to spend a little more time getting their projects exactly as they imagine. 

What software is needed for the projects?

Young people need a web browser so they can follow the project instructions. The first two projects in the path provide detailed instructions for how to install the free software needed for the projects. 

alt=""
The projects in the path show you how to program Raspberry Pi Pico using MicroPython in the Thonny software.

What hardware is needed for these projects?

The first step of each project lists what components are needed to create the project. You can purchase a kit from Kitronik or from Pimoroni that includes all of the components used in the path:

‘Intro to Raspberry Pi Pico’ kit list (click here)

  • 1 × soldered Raspberry Pi Pico
  • 1 × USB cable
  • 1 × red LED
  • 1 × blue LED
  • 2 × yellow LEDs
  • 6 × single-colour LEDs (random)
  • 3 × RGB LEDs
  • 15 × 75 ohm resistors (max 220 ohm)
  • 2 × potentiometers
  • 8 × push buttons (optional, these can be made from crafting materials)
  • 15 × pin–socket jumper wires
  • 38 × socket–socket jumper wires
  • 4 × pin–pin jumper wires

What can young people do next?

Explore Python coding with us 

If your young coders enjoy MicroPython, they’ll also love our Python learning paths: ‘Introduction to Python‘ and ‘More Python‘. Both are structured in the same way as our Pico path, and will help young people learn Python while creating their own visual designs.

A girl points happily at a project on the Raspberry Pi Foundation's projects site.
Details about the projects in ‘Intro to Raspberry Pi Pico’

The ‘Intro to Raspberry Pi Pico’ path is structured according to our Digital Making Framework, with three Explore projects, two Design projects, and a final Invent project. You can also check out our learning graph to see the progression of skills and knowledge throughout the path.

Explore project 1: LED firefly



The ‘LED firefly’ project introduces creators to Raspberry Pi Pico while they make their first project with a blinking LED. They program the LED with a blink pattern that is common to fireflies in the wild. To upgrade their projects, creators can place their LED firefly into a glass jar to create a twinkling effect.  

Explore project 2: Party popper



‘Party popper’ introduces creators to the RGB LED and a buzzer. To form the popper, they craft a pull switch out of kitchen foil and cardboard. When the popper is activated, the RGB LED flashes in their chosen colour, and a ‘tada’ sound plays on the buzzer. 

Explore project 3: Beating heart



‘Beating heart’ uses a potentiometer (dial) to control the pulsing speed of an LED. Creators craft their own hearts using red paper and origami before placing the pulsing LED inside. In this way, they create a model of a heart they can use to learn about medicine or to bring to life a favourite toy. 

Design project 1: Mood indicator



In the ‘Mood indicator’ project, kids use switches and an RGB LED to create a device that can communicate a need or a mood to another person. This Design project gives young creators lots of opportunities to use their new skills to create something personal to them.

Design project 2: Sound machine

 




‘Sound machine’ is a project for kids to work with the different tones that a buzzer can make. They can use the buzzer to create sound effects, or to recreate their favourite songs. Once they have decided on their sounds, they can think about how a user of their project might choose to play them. 

Invent project: Sensory gadget

 




This project gives creators that chance to pick their favourite elements of the path to create something totally unique to them. They could make all sorts of sensory gadgets, from a Picosaber to a candle that can be blown out. Creators are encouraged to showcase their creations in the path gallery to give other young makers inspiration. 

The post Get kids coding and learning electronics with Raspberry Pi Pico appeared first on Raspberry Pi.

Federal Hearing about Rights under GPL

Post Syndicated from Bradley M. Kuhn original http://ebb.org/bkuhn/blog/2022/05/11/vizio-gpl-federal-hearing.html

[ This is
a crosspost
from my professional blog at Software Freedom Conservancy
(SFC). I encourage you
to use
that copy of the post as the canonical linkage for this essay — I
crossposted here merely for posterity and to reach a wider
audience. ]

Possible Opportunity for the Public To Hear Oral Arguments in Key GPL Enforcement Case

In our previous update regarding our copyleft
enforcement lawsuit against Vizio, we talked about how Vizio
“removed” the case to USA federal court (namely, the Central
District of California), and how we filed a motion to “remand”
the case back to state court. While this all seems like minor legal
wrangling early in a case, this very first skirmish in our case goes to the
very heart of the right for software repair for consumers. While it won’t
be a final decision in the case, this motion will be the first indication
whether the federal courts view the GPL as purely a copyright license, or
as a contract, or as both. That question has been central to legal debate
about the GPL for decades, and, thanks to our case, for the first time, a
federal Court will directly consider this question.

Our view (and the view of many attorneys whose opinions we trust) and which is supported by substantial case law, is that the
GPL functions as both a copyright license and a contract, and that third
parties who receive distribution of GPL’d (and LGPL’d) software are
third-party beneficiaries. We’ve done both copyright-based and
contract-based enforcement, and both have their advantages. Contract-based enforcement as a third-party has advantages that are central to the GPL’s policy goals. Consumers are the first to discover violations in the first place. Consumers are the most likely to utilize complete, corresponding source code (CCS) to enhance their use of the products they have purchased. Third-party, contractual based enforcement gives consumers legal authority when they ask companies for access to the source code that should be available to them. In other words, this approach gives consumers the
ability to ask the Court directly for the most
important thing that copyleft assures: a right to receive the
CCS and “the scripts used to control
compilation and installation of the executable”. Indeed, in our suit we have asked only for access to the source code, not for any money.

Our case
now is the first of its kind to adjudicate the third-party beneficiary
contractual theory. We are excited that a federal district Court is poised
to give its first answer to the central question to this endeavor, namely:
“Are the GPL and LGPL merely copyright licenses, and thus
preempted and only subject matter for the US federal courts, or can a
third-party bring a contract claim in state court?” If this
question intrigues you, we encourage you to read our motion
for remand, Vizio’s reply to that motion
and our rebuttal reply.

Most importantly, clear your calendar for this Friday 13 May 2022 at 10:30
US/Pacific! While Judge Staton may chose to rule on this motion strictly
based on those paper filings, the judge has scheduled a hearing for
that date and time. What’s more, anyone in the world can attend this hearing to
listen! Instructions for how to
attend are
found on Judge Staton’s
website0.

While, as FOSS activists, we’re very sad that the Judge has
chosen to use a proprietary videochat platform, we’re glad that
PSTN dial-in
is provided, and we’ll be dialing in and encourage you to do so as well.
Watch our microblog for live updates!

0 Please
take careful note of the warning on the Judge’s website: Recording,
copying, photographing and rebroadcasting of court proceedings is prohibited
by federal law. Remember: you can take as many notes as you like, and
even live blog/microblog what you hear, but take great care to follow the
directives on Judge Staton’s website.

Federal Hearing about Rights under GPL

Post Syndicated from Bradley M. Kuhn original http://ebb.org/bkuhn/blog/2022/05/11/vizio-gpl-federal-hearing.html

[ This is
a crosspost
from my professional blog at Software Freedom Conservancy
(SFC). I encourage you
to use
that copy of the post as the canonical linkage for this essay — I
crossposted here merely for posterity and to reach a wider
audience. ]

Possible Opportunity for the Public To Hear Oral Arguments in Key GPL Enforcement Case

In our previous update regarding our copyleft
enforcement lawsuit against Vizio, we talked about how Vizio
“removed” the case to USA federal court (namely, the Central
District of California), and how we filed a motion to “remand”
the case back to state court. While this all seems like minor legal
wrangling early in a case, this very first skirmish in our case goes to the
very heart of the right for software repair for consumers. While it won’t
be a final decision in the case, this motion will be the first indication
whether the federal courts view the GPL as purely a copyright license, or
as a contract, or as both. That question has been central to legal debate
about the GPL for decades, and, thanks to our case, for the first time, a
federal Court will directly consider this question.

Our view (and the view of many attorneys whose opinions we trust) and which is supported by substantial case law, is that the
GPL functions as both a copyright license and a contract, and that third
parties who receive distribution of GPL’d (and LGPL’d) software are
third-party beneficiaries. We’ve done both copyright-based and
contract-based enforcement, and both have their advantages. Contract-based enforcement as a third-party has advantages that are central to the GPL’s policy goals. Consumers are the first to discover violations in the first place. Consumers are the most likely to utilize complete, corresponding source code (CCS) to enhance their use of the products they have purchased. Third-party, contractual based enforcement gives consumers legal authority when they ask companies for access to the source code that should be available to them. In other words, this approach gives consumers the
ability to ask the Court directly for the most
important thing that copyleft assures: a right to receive the
CCS and “the scripts used to control
compilation and installation of the executable”. Indeed, in our suit we have asked only for access to the source code, not for any money.

Our case
now is the first of its kind to adjudicate the third-party beneficiary
contractual theory. We are excited that a federal district Court is poised
to give its first answer to the central question to this endeavor, namely:
“Are the GPL and LGPL merely copyright licenses, and thus
preempted and only subject matter for the US federal courts, or can a
third-party bring a contract claim in state court?” If this
question intrigues you, we encourage you to read our motion
for remand, Vizio’s reply to that motion
and our rebuttal reply.

Most importantly, clear your calendar for this Friday 13 May 2022 at 10:30
US/Pacific! While Judge Staton may chose to rule on this motion strictly
based on those paper filings, the judge has scheduled a hearing for
that date and time. What’s more, anyone in the world can attend this hearing to
listen! Instructions for how to
attend are
found on Judge Staton’s
website0.

While, as FOSS activists, we’re very sad that the Judge has
chosen to use a proprietary videochat platform, we’re glad that
PSTN dial-in
is provided, and we’ll be dialing in and encourage you to do so as well.
Watch our microblog for live updates!

0 Please
take careful note of the warning on the Judge’s website: Recording,
copying, photographing and rebroadcasting of court proceedings is prohibited
by federal law. Remember: you can take as many notes as you like, and
even live blog/microblog what you hear, but take great care to follow the
directives on Judge Staton’s website.

Federal Hearing about Rights under GPL

Post Syndicated from Bradley M. Kuhn original http://ebb.org/bkuhn/blog/2022/05/11/vizio-gpl-federal-hearing.html

[ This is
a crosspost
from my professional blog at Software Freedom Conservancy
(SFC). I encourage you
to use
that copy of the post as the canonical linkage for this essay — I
crossposted here merely for posterity and to reach a wider
audience. ]

Possible Opportunity for the Public To Hear Oral Arguments in Key GPL Enforcement Case

In our previous update regarding our copyleft
enforcement lawsuit against Vizio, we talked about how Vizio
“removed” the case to USA federal court (namely, the Central
District of California), and how we filed a motion to “remand”
the case back to state court. While this all seems like minor legal
wrangling early in a case, this very first skirmish in our case goes to the
very heart of the right for software repair for consumers. While it won’t
be a final decision in the case, this motion will be the first indication
whether the federal courts view the GPL as purely a copyright license, or
as a contract, or as both. That question has been central to legal debate
about the GPL for decades, and, thanks to our case, for the first time, a
federal Court will directly consider this question.

Our view (and the view of many attorneys whose opinions we trust) and which is supported by substantial case law, is that the
GPL functions as both a copyright license and a contract, and that third
parties who receive distribution of GPL’d (and LGPL’d) software are
third-party beneficiaries. We’ve done both copyright-based and
contract-based enforcement, and both have their advantages. Contract-based enforcement as a third-party has advantages that are central to the GPL’s policy goals. Consumers are the first to discover violations in the first place. Consumers are the most likely to utilize complete, corresponding source code (CCS) to enhance their use of the products they have purchased. Third-party, contractual based enforcement gives consumers legal authority when they ask companies for access to the source code that should be available to them. In other words, this approach gives consumers the
ability to ask the Court directly for the most
important thing that copyleft assures: a right to receive the
CCS and “the scripts used to control
compilation and installation of the executable”. Indeed, in our suit we have asked only for access to the source code, not for any money.

Our case
now is the first of its kind to adjudicate the third-party beneficiary
contractual theory. We are excited that a federal district Court is poised
to give its first answer to the central question to this endeavor, namely:
“Are the GPL and LGPL merely copyright licenses, and thus
preempted and only subject matter for the US federal courts, or can a
third-party bring a contract claim in state court?” If this
question intrigues you, we encourage you to read our motion
for remand, Vizio’s reply to that motion
and our rebuttal reply.

Most importantly, clear your calendar for this Friday 13 May 2022 at 10:30
US/Pacific! While Judge Staton may chose to rule on this motion strictly
based on those paper filings, the judge has scheduled a hearing for
that date and time. What’s more, anyone in the world can attend this hearing to
listen! Instructions for how to
attend are
found on Judge Staton’s
website0.

While, as FOSS activists, we’re very sad that the Judge has
chosen to use a proprietary videochat platform, we’re glad that
PSTN dial-in
is provided, and we’ll be dialing in and encourage you to do so as well.
Watch our microblog for live updates!

0 Please
take careful note of the warning on the Judge’s website: Recording,
copying, photographing and rebroadcasting of court proceedings is prohibited
by federal law. Remember: you can take as many notes as you like, and
even live blog/microblog what you hear, but take great care to follow the
directives on Judge Staton’s website.

Federal Hearing about Rights under GPL

Post Syndicated from Bradley M. Kuhn original http://ebb.org/bkuhn/blog/2022/05/11/vizio-gpl-federal-hearing.html

[ This is
a crosspost
from my professional blog at Software Freedom Conservancy
(SFC). I encourage you
to use
that copy of the post as the canonical linkage for this essay — I
crossposted here merely for posterity and to reach a wider
audience. ]

Possible Opportunity for the Public To Hear Oral Arguments in Key GPL Enforcement Case

In our previous update regarding our copyleft
enforcement lawsuit against Vizio, we talked about how Vizio
“removed” the case to USA federal court (namely, the Central
District of California), and how we filed a motion to “remand”
the case back to state court. While this all seems like minor legal
wrangling early in a case, this very first skirmish in our case goes to the
very heart of the right for software repair for consumers. While it won’t
be a final decision in the case, this motion will be the first indication
whether the federal courts view the GPL as purely a copyright license, or
as a contract, or as both. That question has been central to legal debate
about the GPL for decades, and, thanks to our case, for the first time, a
federal Court will directly consider this question.

Our view (and the view of many attorneys whose opinions we trust) and which is supported by substantial case law, is that the
GPL functions as both a copyright license and a contract, and that third
parties who receive distribution of GPL’d (and LGPL’d) software are
third-party beneficiaries. We’ve done both copyright-based and
contract-based enforcement, and both have their advantages. Contract-based enforcement as a third-party has advantages that are central to the GPL’s policy goals. Consumers are the first to discover violations in the first place. Consumers are the most likely to utilize complete, corresponding source code (CCS) to enhance their use of the products they have purchased. Third-party, contractual based enforcement gives consumers legal authority when they ask companies for access to the source code that should be available to them. In other words, this approach gives consumers the
ability to ask the Court directly for the most
important thing that copyleft assures: a right to receive the
CCS and “the scripts used to control
compilation and installation of the executable”. Indeed, in our suit we have asked only for access to the source code, not for any money.

Our case
now is the first of its kind to adjudicate the third-party beneficiary
contractual theory. We are excited that a federal district Court is poised
to give its first answer to the central question to this endeavor, namely:
“Are the GPL and LGPL merely copyright licenses, and thus
preempted and only subject matter for the US federal courts, or can a
third-party bring a contract claim in state court?” If this
question intrigues you, we encourage you to read our motion
for remand, Vizio’s reply to that motion
and our rebuttal reply.

Most importantly, clear your calendar for this Friday 13 May 2022 at 10:30
US/Pacific! While Judge Staton may chose to rule on this motion strictly
based on those paper filings, the judge has scheduled a hearing for
that date and time. What’s more, anyone in the world can attend this hearing to
listen! Instructions for how to
attend are
found on Judge Staton’s
website0.

While, as FOSS activists, we’re very sad that the Judge has
chosen to use a proprietary videochat platform, we’re glad that
PSTN dial-in
is provided, and we’ll be dialing in and encourage you to do so as well.
Watch our microblog for live updates!

0 Please
take careful note of the warning on the Judge’s website: Recording,
copying, photographing and rebroadcasting of court proceedings is prohibited
by federal law. Remember: you can take as many notes as you like, and
even live blog/microblog what you hear, but take great care to follow the
directives on Judge Staton’s website.

Federal Hearing about Rights under GPL

Post Syndicated from Bradley M. Kuhn original http://ebb.org/bkuhn/blog/2022/05/11/vizio-gpl-federal-hearing.html

[ This is
a crosspost
from my professional blog at Software Freedom Conservancy
(SFC). I encourage you
to use
that copy of the post as the canonical linkage for this essay — I
crossposted here merely for posterity and to reach a wider
audience. ]

Possible Opportunity for the Public To Hear Oral Arguments in Key GPL Enforcement Case

In our previous update regarding our copyleft
enforcement lawsuit against Vizio, we talked about how Vizio
“removed” the case to USA federal court (namely, the Central
District of California), and how we filed a motion to “remand”
the case back to state court. While this all seems like minor legal
wrangling early in a case, this very first skirmish in our case goes to the
very heart of the right for software repair for consumers. While it won’t
be a final decision in the case, this motion will be the first indication
whether the federal courts view the GPL as purely a copyright license, or
as a contract, or as both. That question has been central to legal debate
about the GPL for decades, and, thanks to our case, for the first time, a
federal Court will directly consider this question.

Our view (and the view of many attorneys whose opinions we trust) and which is supported by substantial case law, is that the
GPL functions as both a copyright license and a contract, and that third
parties who receive distribution of GPL’d (and LGPL’d) software are
third-party beneficiaries. We’ve done both copyright-based and
contract-based enforcement, and both have their advantages. Contract-based enforcement as a third-party has advantages that are central to the GPL’s policy goals. Consumers are the first to discover violations in the first place. Consumers are the most likely to utilize complete, corresponding source code (CCS) to enhance their use of the products they have purchased. Third-party, contractual based enforcement gives consumers legal authority when they ask companies for access to the source code that should be available to them. In other words, this approach gives consumers the
ability to ask the Court directly for the most
important thing that copyleft assures: a right to receive the
CCS and “the scripts used to control
compilation and installation of the executable”. Indeed, in our suit we have asked only for access to the source code, not for any money.

Our case
now is the first of its kind to adjudicate the third-party beneficiary
contractual theory. We are excited that a federal district Court is poised
to give its first answer to the central question to this endeavor, namely:
“Are the GPL and LGPL merely copyright licenses, and thus
preempted and only subject matter for the US federal courts, or can a
third-party bring a contract claim in state court?” If this
question intrigues you, we encourage you to read our motion
for remand, Vizio’s reply to that motion
and our rebuttal reply.

Most importantly, clear your calendar for this Friday 13 May 2022 at 10:30
US/Pacific! While Judge Staton may chose to rule on this motion strictly
based on those paper filings, the judge has scheduled a hearing for
that date and time. What’s more, anyone in the world can attend this hearing to
listen! Instructions for how to
attend are
found on Judge Staton’s
website0.

While, as FOSS activists, we’re very sad that the Judge has
chosen to use a proprietary videochat platform, we’re glad that
PSTN dial-in
is provided, and we’ll be dialing in and encourage you to do so as well.
Watch our microblog for live updates!

0 Please
take careful note of the warning on the Judge’s website: Recording,
copying, photographing and rebroadcasting of court proceedings is prohibited
by federal law. Remember: you can take as many notes as you like, and
even live blog/microblog what you hear, but take great care to follow the
directives on Judge Staton’s website.

Federal Hearing about Rights under GPL

Post Syndicated from Bradley M. Kuhn original http://ebb.org/bkuhn/blog/2022/05/11/vizio-gpl-federal-hearing.html

[ This is
a crosspost
from my professional blog at Software Freedom Conservancy
(SFC). I encourage you
to use
that copy of the post as the canonical linkage for this essay — I
crossposted here merely for posterity and to reach a wider
audience. ]

Possible Opportunity for the Public To Hear Oral Arguments in Key GPL Enforcement Case

In our previous update regarding our copyleft
enforcement lawsuit against Vizio, we talked about how Vizio
“removed” the case to USA federal court (namely, the Central
District of California), and how we filed a motion to “remand”
the case back to state court. While this all seems like minor legal
wrangling early in a case, this very first skirmish in our case goes to the
very heart of the right for software repair for consumers. While it won’t
be a final decision in the case, this motion will be the first indication
whether the federal courts view the GPL as purely a copyright license, or
as a contract, or as both. That question has been central to legal debate
about the GPL for decades, and, thanks to our case, for the first time, a
federal Court will directly consider this question.

Our view (and the view of many attorneys whose opinions we trust) and which is supported by substantial case law, is that the
GPL functions as both a copyright license and a contract, and that third
parties who receive distribution of GPL’d (and LGPL’d) software are
third-party beneficiaries. We’ve done both copyright-based and
contract-based enforcement, and both have their advantages. Contract-based enforcement as a third-party has advantages that are central to the GPL’s policy goals. Consumers are the first to discover violations in the first place. Consumers are the most likely to utilize complete, corresponding source code (CCS) to enhance their use of the products they have purchased. Third-party, contractual based enforcement gives consumers legal authority when they ask companies for access to the source code that should be available to them. In other words, this approach gives consumers the
ability to ask the Court directly for the most
important thing that copyleft assures: a right to receive the
CCS and “the scripts used to control
compilation and installation of the executable”. Indeed, in our suit we have asked only for access to the source code, not for any money.

Our case
now is the first of its kind to adjudicate the third-party beneficiary
contractual theory. We are excited that a federal district Court is poised
to give its first answer to the central question to this endeavor, namely:
“Are the GPL and LGPL merely copyright licenses, and thus
preempted and only subject matter for the US federal courts, or can a
third-party bring a contract claim in state court?” If this
question intrigues you, we encourage you to read our motion
for remand, Vizio’s reply to that motion
and our rebuttal reply.

Most importantly, clear your calendar for this Friday 13 May 2022 at 10:30
US/Pacific! While Judge Staton may chose to rule on this motion strictly
based on those paper filings, the judge has scheduled a hearing for
that date and time. What’s more, anyone in the world can attend this hearing to
listen! Instructions for how to
attend are
found on Judge Staton’s
website0.

While, as FOSS activists, we’re very sad that the Judge has
chosen to use a proprietary videochat platform, we’re glad that
PSTN dial-in
is provided, and we’ll be dialing in and encourage you to do so as well.
Watch our microblog for live updates!

0 Please
take careful note of the warning on the Judge’s website: Recording,
copying, photographing and rebroadcasting of court proceedings is prohibited
by federal law. Remember: you can take as many notes as you like, and
even live blog/microblog what you hear, but take great care to follow the
directives on Judge Staton’s website.

Federal Hearing about Rights under GPL

Post Syndicated from Bradley M. Kuhn original http://ebb.org/bkuhn/blog/2022/05/11/vizio-gpl-federal-hearing.html

[ This is
a crosspost
from my professional blog at Software Freedom Conservancy
(SFC). I encourage you
to use
that copy of the post as the canonical linkage for this essay — I
crossposted here merely for posterity and to reach a wider
audience. ]

Possible Opportunity for the Public To Hear Oral Arguments in Key GPL Enforcement Case

In our previous update regarding our copyleft
enforcement lawsuit against Vizio, we talked about how Vizio
“removed” the case to USA federal court (namely, the Central
District of California), and how we filed a motion to “remand”
the case back to state court. While this all seems like minor legal
wrangling early in a case, this very first skirmish in our case goes to the
very heart of the right for software repair for consumers. While it won’t
be a final decision in the case, this motion will be the first indication
whether the federal courts view the GPL as purely a copyright license, or
as a contract, or as both. That question has been central to legal debate
about the GPL for decades, and, thanks to our case, for the first time, a
federal Court will directly consider this question.

Our view (and the view of many attorneys whose opinions we trust) and which is supported by substantial case law, is that the
GPL functions as both a copyright license and a contract, and that third
parties who receive distribution of GPL’d (and LGPL’d) software are
third-party beneficiaries. We’ve done both copyright-based and
contract-based enforcement, and both have their advantages. Contract-based enforcement as a third-party has advantages that are central to the GPL’s policy goals. Consumers are the first to discover violations in the first place. Consumers are the most likely to utilize complete, corresponding source code (CCS) to enhance their use of the products they have purchased. Third-party, contractual based enforcement gives consumers legal authority when they ask companies for access to the source code that should be available to them. In other words, this approach gives consumers the
ability to ask the Court directly for the most
important thing that copyleft assures: a right to receive the
CCS and “the scripts used to control
compilation and installation of the executable”. Indeed, in our suit we have asked only for access to the source code, not for any money.

Our case
now is the first of its kind to adjudicate the third-party beneficiary
contractual theory. We are excited that a federal district Court is poised
to give its first answer to the central question to this endeavor, namely:
“Are the GPL and LGPL merely copyright licenses, and thus
preempted and only subject matter for the US federal courts, or can a
third-party bring a contract claim in state court?” If this
question intrigues you, we encourage you to read our motion
for remand, Vizio’s reply to that motion
and our rebuttal reply.

Most importantly, clear your calendar for this Friday 13 May 2022 at 10:30
US/Pacific! While Judge Staton may chose to rule on this motion strictly
based on those paper filings, the judge has scheduled a hearing for
that date and time. What’s more, anyone in the world can attend this hearing to
listen! Instructions for how to
attend are
found on Judge Staton’s
website0.

While, as FOSS activists, we’re very sad that the Judge has
chosen to use a proprietary videochat platform, we’re glad that
PSTN dial-in
is provided, and we’ll be dialing in and encourage you to do so as well.
Watch our microblog for live updates!

0 Please
take careful note of the warning on the Judge’s website: Recording,
copying, photographing and rebroadcasting of court proceedings is prohibited
by federal law. Remember: you can take as many notes as you like, and
even live blog/microblog what you hear, but take great care to follow the
directives on Judge Staton’s website.

[$] Page pinning and filesystems

Post Syndicated from original https://lwn.net/Articles/894390/

It would have been surprising indeed if the 2022 Linux Storage,
Filesystem, Memory-management and BPF Summit (LSFMM) did not include a
session working toward solutions to the longstanding problems with
get_user_pages(), an internal function that locks user-space pages
in memory for access by the kernel. The issue has, after all, come up numerous times
over the years. This year’s event duly contained a session in the joint
filesystem and memory-management track, led by John Hubbard, with a focus
on page pinning and how it interacts with filesystems.

Establishing a data perimeter on AWS

Post Syndicated from Ilya Epshteyn original https://aws.amazon.com/blogs/security/establishing-a-data-perimeter-on-aws/

For your sensitive data on AWS, you should implement security controls, including identity and access management, infrastructure security, and data protection. Amazon Web Services (AWS) recommends that you set up multiple accounts as your workloads grow to isolate applications and data that have specific security requirements. AWS tools can help you establish a data perimeter between your multiple accounts, while blocking unintended access from outside of your organization. Data perimeters on AWS span many different features and capabilities. Based on your security requirements, you should decide which capabilities are appropriate for your organization. In this first blog post on data perimeters, I discuss which AWS Identity and Access Management (IAM) features and capabilities you can use to establish a data perimeter on AWS. Subsequent posts will provide implementation guidance and IAM policy examples for establishing your identity, resource, and network data perimeters.

A data perimeter is a set of preventive guardrails that help ensure that only your trusted identities are accessing trusted resources from expected networks. These terms are defined as follows:

  • Trusted identities – Principals (IAM roles or users) within your AWS accounts, or AWS services that are acting on your behalf
  • Trusted resources – Resources that are owned by your AWS accounts, or by AWS services that are acting on your behalf
  • Expected networks – Your on-premises data centers and virtual private clouds (VPCs), or networks of AWS services that are acting on your behalf

Data perimeter guardrails

You typically implement data perimeter guardrails as coarse-grained controls that apply across a broad set of AWS accounts and resources. When you implement a data perimeter, consider the following six primary control objectives.

Data perimeter Control objective
Identity Only trusted identities can access my resources.
Only trusted identities are allowed from my network.
Resource My identities can access only trusted resources.
Only trusted resources can be accessed from my network.
Network My identities can access resources only from expected networks.
My resources can only be accessed from expected networks.

Note that the controls in the preceding table are coarse in nature and are meant to serve as always-on boundaries. You can think of data perimeters as creating a firm boundary around your data to prevent unintended access patterns. Although data perimeters can prevent broad unintended access, you still need to make fine-grained access control decisions. Establishing a data perimeter does not diminish the need to continuously fine-tune permissions by using tools such as IAM Access Analyzer as part of your journey to least privilege.

To implement the preceding control objectives on AWS, use three primary capabilities:

Let’s expand the previous table to include the corresponding policies you would use to implement the controls for each of the control objectives.

Data perimeter Control objective Implemented by using
Identity Only trusted identities can access my resources. Resource-based policies
Only trusted identities are allowed from my network. VPC endpoint policies
Resource My identities can access only trusted resources. SCPs
Only trusted resources can be accessed from my network. VPC endpoint policies
Network My identities can access resources only from expected networks. SCPs
My resources can only be accessed from expected networks. Resource-based policies

As you can see in the preceding table, the correct policy for each control objective depends on which resource you are trying to secure. Resource-based policies, which are applied to resources such as Amazon S3 buckets, can be used to filter access based on the calling principal and the network from which they are making a call. VPC endpoint policies are used to inspect the principal that is making the API call and the resource they are trying to access. And SCPs are used to restrict your identities from accessing resources outside your control or from outside your network. Note that SCPs apply only to your principals within your AWS organization, whereas resource policies can be used to limit access to all principals.

The last components are the specific IAM controls or condition keys that enforce the control objective. For effective data perimeter controls, use the following primary IAM condition keys, including the new resource owner condition keys:

  • aws:PrincipalOrgID – Use this condition key to restrict access to trusted identities, your principals (roles or users) that belong to your organization. In the context of a data perimeter, you will use this condition key with your resource-based policies and VPC endpoint policies.
  • aws:ResourceOrgID – Use this condition key to restrict access to resources that belong to your AWS organization. To establish a data perimeter, you will use this condition key within SCPs and VPC endpoint policies.
  • aws:SourceIp, aws:SourceVpc, aws:SourceVpce – Use these condition keys to restrict access to expected network locations, such as your corporate network or your VPCs. In the context of a data perimeter, you will use these keys within identity and resource-based policies.

We can now complete the table that we’ve been developing throughout this post.

Data perimeter Control objective Implemented by using Primary IAM capability
Identity Only trusted identities can access my resources. Resource-based policies aws:PrincipalOrgID
aws:PrincipalIsAWSService
Only trusted identities are allowed from my network. VPC endpoint policies aws:PrincipalOrgID
Resource My identities can access only trusted resources. SCPs aws:ResourceOrgID
Only trusted resources can be accessed from my network. VPC endpoint policies aws:ResourceOrgID
Network My identities can access resources only from expected networks. SCPs aws:SourceIp
aws:SourceVpc
aws:SourceVpce
aws:ViaAWSService
My resources can only be accessed from expected networks. Resource-based policies aws:SourceIp
aws:SourceVpc
aws:SourceVpce
aws:ViaAWSService
aws:PrincipalIsAWSService

For the identity data perimeter, the primary condition key is aws:PrincipalOrgID, which you can use in resource-based policies and VPC endpoint policies so that only your identities are allowed access. Use aws:PrincipalIsAWSService to allow AWS services to access your resources by using their own identities—for example, AWS CloudTrail can use this access to write data to your bucket.

For the resource data perimeter, the primary condition key is aws:ResourceOrgID, which you can use in an SCP policy or VPC endpoint policy to allow your identities and network to access only the resources that belong to your AWS organization.

Last, for the network perimeter, use the aws:SourceIp, aws:SourceVpc, and aws:SourceVpce condition keys in SCPs and resource-based policies to make sure that your identities and resources are accessed only from your trusted network. Use the aws:PrincipalIsAWSService and aws:ViaAWSService condition keys to allow AWS services to access your resources from outside your network locations. For example, CloudTrail can use this access to write data to one of your S3 buckets, or Amazon Athena can query data in your S3 buckets. For more information about using these keys as part of your data perimeter strategy, see the blog post IAM makes it easier for you to manage permissions for AWS services accessing your resources.

Conclusion

In this blog post, you learned the foundational elements that are needed to implement an identity, resource, and network data perimeter on AWS, including the primary IAM capabilities that are used to implement each of the control objectives. Stay tuned to the follow-up posts in this series, which will provide prescriptive guidance on establishing your identity, resource, and network data perimeters.

Following are additional resources that will help you further explore the data perimeter topic, including a whitepaper and a hands-on-workshop. We have also curated several blog posts related to the key IAM capabilities discussed in this post.

If you have any questions, comments, or concerns, contact AWS Support or start a new thread on the IAM forum. If you have feedback about this post, submit comments in the Comments section below.

Want more AWS Security news? Follow us on Twitter.

Author

Ilya Epshteyn

Ilya is a Senior Manager of Identity Solutions in AWS Identity. He helps customers to innovate on AWS by building highly secure, available, and scalable architectures. He enjoys spending time outdoors and building Lego creations with his kids.

[$] Recent RCU changes

Post Syndicated from original https://lwn.net/Articles/894379/

In a combined filesystem and memory-management session at the 2022 Linux Storage,
Filesystem, Memory-management and BPF Summit (LSFMM), Paul McKenney
gave an update on
the changes to the read-copy-update (RCU) subsystem that had been made over
the last several years. He started with a quick overview of what RCU is
and why it exists at all. He did not go into any
real depth, though, since many of the topics could take a 90-minute session of their
own, he said, but he did provide some descriptions of the work that has gone into
RCU recently.

Patch Tuesday – May 2022

Post Syndicated from Greg Wiseman original https://blog.rapid7.com/2022/05/10/patch-tuesday-may-2022/

Patch Tuesday - May 2022

This month is par for the course in terms of both number and severity of vulnerabilities being patched by Microsoft. That means there’s plenty of work to be done by system and network administrators, as usual.

There is one 0-day this month: CVE-2022-26925, a Spoofing vulnerability in the Windows Local Security Authority (LSA) subsystem, which allows attackers able to perform a man-in-the-middle attack to force domain controllers to authenticate to the attacker using NTLM authentication. This is very bad news when used in conjunction with an NTLM relay attack, potentially leading to remote code execution (RCE). This bug affects all supported versions of Windows, but Domain Controllers should be patched on a priority basis before updating other servers.

Two other CVEs were also publicly disclosed before today’s releases, though they have not yet been seen exploited in the wild. CVE-2022-22713 is a denial-of-service vulnerability that affects Hyper-V servers running relatively recent versions of Windows (20H2 and later). CVE-2022-29972 is a Critical RCE that affects the Amazon Redshift ODBC driver used by Microsoft’s Self-hosted Integration Runtime (a client agent that enables on-premises data sources to exchange data with cloud services such as Azure Data Factory and Azure Synapse Pipelines). This vulnerability also prompted Microsoft to publish their first guidance-based advisory of the year, ADV220001, indicating their plans to strengthen tenant isolation in their cloud services without actually providing any specific details or actions to be taken by customers.

All told, 74 CVEs were fixed this month, the vast majority of which affect functionality within the Windows operating system. Other notable vulnerabilities include CVE-2022-21972 and CVE-2022-23270, critical RCEs in the Point-to-Point Tunneling Protocol. Exploitation requires attackers to win a race condition, which increases the complexity, but if you have any RAS servers in your environment, patch sooner rather than later.

CVE-2022-26937 carries a CVSSv3 score of 9.8 and affects services using the Windows Network File System (NFS). This can be mitigated by disabling NFSV2 and NFSV3 on the server; however, this may cause compatibility issues, and upgrading is highly recommended.

CVE-2022-22017 is yet another client-side Remote Desktop Protocol (RDP) vulnerability. While not as worrisome as when an RCE affects RDP servers, if a user can be enticed to connect to a malicious RDP server via social engineering tactics, an attacker will gain RCE on their system.

Sharepoint Server administrators should be aware of CVE-2022-29108, a post-authentication RCE fixed today. Exchange admins have CVE-2022-21978 to worry about, which could allow an attacker with elevated privileges on an Exchange server to gain the rights of a Domain Administrator.

A host of Lightweight Directory Access Protocol (LDAP) vulnerabilities were also addressed this month, including CVE-2022-22012 and CVE-2022-29130 – both RCEs that, thankfully, are only exploitable if the MaxReceiveBuffer LDAP policy is set to a value higher than the default value.

Although there are no browser vulnerabilities this month, two RCEs affecting Excel (CVE-2022-29109 and CVE-2022-29110) and one Security Feature Bypass affecting Office (CVE-2022-29107) mean there is still some endpoint application patching to do.

Summary charts

Patch Tuesday - May 2022
Patch Tuesday - May 2022
Patch Tuesday - May 2022
Patch Tuesday - May 2022

Summary tables

Azure vulnerabilities

CVE Title Exploited? Publicly disclosed? CVSSv3 base score Has FAQ?
CVE-2022-29972 Insight Software: CVE-2022-29972 Magnitude Simba Amazon Redshift ODBC Driver No Yes N/A Yes

Developer Tools vulnerabilities

CVE Title Exploited? Publicly disclosed? CVSSv3 base score Has FAQ?
CVE-2022-29148 Visual Studio Remote Code Execution Vulnerability No No 7.8 Yes
CVE-2022-30129 Visual Studio Code Remote Code Execution Vulnerability No No 8.8 Yes
CVE-2022-23267 .NET and Visual Studio Denial of Service Vulnerability No No 7.5 No
CVE-2022-29117 .NET and Visual Studio Denial of Service Vulnerability No No 7.5 No
CVE-2022-29145 .NET and Visual Studio Denial of Service Vulnerability No No 7.5 No
CVE-2022-30130 .NET Framework Denial of Service Vulnerability No No 3.3 No

ESU Windows vulnerabilities

CVE Title Exploited? Publicly disclosed? CVSSv3 base score Has FAQ?
CVE-2022-26935 Windows WLAN AutoConfig Service Information Disclosure Vulnerability No No 6.5 Yes
CVE-2022-29121 Windows WLAN AutoConfig Service Denial of Service Vulnerability No No 6.5 Yes
CVE-2022-26936 Windows Server Service Information Disclosure Vulnerability No No 6.5 Yes
CVE-2022-22015 Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability No No 6.5 Yes
CVE-2022-29103 Windows Remote Access Connection Manager Elevation of Privilege Vulnerability No No 7.8 No
CVE-2022-29132 Windows Print Spooler Elevation of Privilege Vulnerability No No 7.8 No
CVE-2022-26937 Windows Network File System Remote Code Execution Vulnerability No No 9.8 Yes
CVE-2022-26925 Windows LSA Spoofing Vulnerability Yes Yes 8.1 Yes
CVE-2022-22012 Windows LDAP Remote Code Execution Vulnerability No No 9.8 Yes
CVE-2022-29130 Windows LDAP Remote Code Execution Vulnerability No No 9.8 Yes
CVE-2022-22013 Windows LDAP Remote Code Execution Vulnerability No No 8.8 No
CVE-2022-22014 Windows LDAP Remote Code Execution Vulnerability No No 8.8 No
CVE-2022-29128 Windows LDAP Remote Code Execution Vulnerability No No 8.8 Yes
CVE-2022-29129 Windows LDAP Remote Code Execution Vulnerability No No 8.8 Yes
CVE-2022-29137 Windows LDAP Remote Code Execution Vulnerability No No 8.8 No
CVE-2022-29139 Windows LDAP Remote Code Execution Vulnerability No No 8.8 Yes
CVE-2022-29141 Windows LDAP Remote Code Execution Vulnerability No No 8.8 No
CVE-2022-26931 Windows Kerberos Elevation of Privilege Vulnerability No No 7.5 Yes
CVE-2022-26934 Windows Graphics Component Information Disclosure Vulnerability No No 6.5 Yes
CVE-2022-29112 Windows Graphics Component Information Disclosure Vulnerability No No 6.5 Yes
CVE-2022-22011 Windows Graphics Component Information Disclosure Vulnerability No No 5.5 Yes
CVE-2022-29115 Windows Fax Service Remote Code Execution Vulnerability No No 7.8 Yes
CVE-2022-26926 Windows Address Book Remote Code Execution Vulnerability No No 7.8 Yes
CVE-2022-22019 Remote Procedure Call Runtime Remote Code Execution Vulnerability No No 8.8 Yes
CVE-2022-21972 Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability No No 8.1 Yes
CVE-2022-23270 Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability No No 8.1 Yes
CVE-2022-29105 Microsoft Windows Media Foundation Remote Code Execution Vulnerability No No 7.8 No
CVE-2022-29127 BitLocker Security Feature Bypass Vulnerability No No 4.2 Yes

Exchange Server vulnerabilities

CVE Title Exploited? Publicly disclosed? CVSSv3 base score Has FAQ?
CVE-2022-21978 Microsoft Exchange Server Elevation of Privilege Vulnerability No No 8.2 Yes

Microsoft Office vulnerabilities

CVE Title Exploited? Publicly disclosed? CVSSv3 base score Has FAQ?
CVE-2022-29108 Microsoft SharePoint Server Remote Code Execution Vulnerability No No 8.8 Yes
CVE-2022-29107 Microsoft Office Security Feature Bypass Vulnerability No No 5.5 Yes
CVE-2022-29109 Microsoft Excel Remote Code Execution Vulnerability No No 7.8 Yes
CVE-2022-29110 Microsoft Excel Remote Code Execution Vulnerability No No 7.8 Yes

Windows vulnerabilities

CVE Title Exploited? Publicly disclosed? CVSSv3 base score Has FAQ?
CVE-2022-26930 Windows Remote Access Connection Manager Information Disclosure Vulnerability No No 5.5 Yes
CVE-2022-29125 Windows Push Notifications Apps Elevation of Privilege Vulnerability No No 7 Yes
CVE-2022-29114 Windows Print Spooler Information Disclosure Vulnerability No No 5.5 Yes
CVE-2022-29140 Windows Print Spooler Information Disclosure Vulnerability No No 5.5 Yes
CVE-2022-29104 Windows Print Spooler Elevation of Privilege Vulnerability No No 7.8 No
CVE-2022-22016 Windows PlayToManager Elevation of Privilege Vulnerability No No 7 Yes
CVE-2022-26933 Windows NTFS Information Disclosure Vulnerability No No 5.5 Yes
CVE-2022-29131 Windows LDAP Remote Code Execution Vulnerability No No 8.8 Yes
CVE-2022-29116 Windows Kernel Information Disclosure Vulnerability No No 4.7 Yes
CVE-2022-29133 Windows Kernel Elevation of Privilege Vulnerability No No 8.8 Yes
CVE-2022-29142 Windows Kernel Elevation of Privilege Vulnerability No No 7 Yes
CVE-2022-29106 Windows Hyper-V Shared Virtual Disk Elevation of Privilege Vulnerability No No 7 Yes
CVE-2022-24466 Windows Hyper-V Security Feature Bypass Vulnerability No No 4.1 Yes
CVE-2022-22713 Windows Hyper-V Denial of Service Vulnerability No Yes 5.6 Yes
CVE-2022-26927 Windows Graphics Component Remote Code Execution Vulnerability No No 8.8 Yes
CVE-2022-29102 Windows Failover Cluster Information Disclosure Vulnerability No No 5.5 Yes
CVE-2022-29113 Windows Digital Media Receiver Elevation of Privilege Vulnerability No No 7.8 Yes
CVE-2022-29134 Windows Clustered Shared Volume Information Disclosure Vulnerability No No 6.5 Yes
CVE-2022-29120 Windows Clustered Shared Volume Information Disclosure Vulnerability No No 6.5 Yes
CVE-2022-29122 Windows Clustered Shared Volume Information Disclosure Vulnerability No No 6.5 Yes
CVE-2022-29123 Windows Clustered Shared Volume Information Disclosure Vulnerability No No 6.5 Yes
CVE-2022-29138 Windows Clustered Shared Volume Elevation of Privilege Vulnerability No No 7 Yes
CVE-2022-29135 Windows Cluster Shared Volume (CSV) Elevation of Privilege Vulnerability No No 7 Yes
CVE-2022-29150 Windows Cluster Shared Volume (CSV) Elevation of Privilege Vulnerability No No 7 Yes
CVE-2022-29151 Windows Cluster Shared Volume (CSV) Elevation of Privilege Vulnerability No No 7 Yes
CVE-2022-26913 Windows Authentication Security Feature Bypass Vulnerability No No 7.4 Yes
CVE-2022-23279 Windows ALPC Elevation of Privilege Vulnerability No No 7 Yes
CVE-2022-29126 Tablet Windows User Interface Application Core Elevation of Privilege Vulnerability No No 7 Yes
CVE-2022-26932 Storage Spaces Direct Elevation of Privilege Vulnerability No No 8.2 Yes
CVE-2022-26938 Storage Spaces Direct Elevation of Privilege Vulnerability No No 7 Yes
CVE-2022-26939 Storage Spaces Direct Elevation of Privilege Vulnerability No No 7 Yes
CVE-2022-26940 Remote Desktop Protocol Client Information Disclosure Vulnerability No No 6.5 Yes
CVE-2022-22017 Remote Desktop Client Remote Code Execution Vulnerability No No 8.8 Yes
CVE-2022-26923 Active Directory Domain Services Elevation of Privilege Vulnerability No No 8.8 Yes

NEVER MISS A BLOG

Get the latest stories, expertise, and news about security today.

Analyze Amazon SES events at scale using Amazon Redshift

Post Syndicated from Manash Deb original https://aws.amazon.com/blogs/big-data/analyze-amazon-ses-events-at-scale-using-amazon-redshift/

Email is one of the most important methods for business communication across many organizations. It’s also one of the primary methods for many businesses to communicate with their customers. With the ever-increasing necessity to send emails at scale, monitoring and analysis has become a major challenge.

Amazon Simple Email Service (Amazon SES) is a cost-effective, flexible, and scalable email service that enables you to send and receive emails from your applications. You can use Amazon SES for several use cases, such as transactional, marketing, or mass email communications.

An important benefit of Amazon SES is its native integration with other AWS services, such as Amazon CloudWatch and Amazon Redshift, which allows you to monitor and analyze your emails sending at scale seamlessly. You can store your email events in Amazon Redshift, which is a widely used, fast, and fully managed cloud data warehouse. You can then analyze these events using SQL to gain business insights such as marketing campaign success, email bounces, complaints, and so on.

In this post, you will learn how to implement an end-to-end solution to automate this email analysis and monitoring process.

Solution overview

The following architecture diagram highlights the end-to-end solution, which you can provision automatically with an AWS CloudFormation template.

In this solution, you publish Amazon SES email events to an Amazon Kinesis Data Firehose delivery stream that publishes data to Amazon Redshift. You then connect to the Amazon Redshift database and use a SQL query tool to analyze Amazon SES email events that meet the given criteria. We use the Amazon Redshift SUPER data type to store the event (JSON data) in Amazon Redshift. The SUPER data type handles semi-structured data, which can have varying table attributes and types.

The alarm system uses Amazon CloudWatch logs that Kinesis Data Firehose generates when a data load to Amazon Redshift fails. We have set up a metric filter that pattern matches the CloudWatch log events to determine the error condition and triggers a CloudWatch alarm. This in turn sends out email notifications using Amazon Simple Notification Service (Amazon SNS).

Prerequisites

As a prerequisite for deploying the solution in this post, you need to set up Amazon SES in your account. For more information, see Getting Started with Amazon Simple Email Service.

Solution resources and features

The architecture built by AWS CloudFormation supports AWS best practices for high availability and security. The CloudFormation template takes care of the following key resources and features:

  • Amazon Redshift cluster – An Amazon Redshift cluster with encryption at rest enabled using an AWS Key Management Service (AWS KMS) customer managed key (CMK). This cluster acts as the destination for Kinesis Data Firehose and stores all the Amazon SES email sending events in the table ses, as shown in the following screenshot.
  • Kinesis Data Firehose configuration – A Kinesis Data Firehose delivery stream that acts as the event destination for all Amazon SES email sending metrics. The delivery stream is set up with Amazon Redshift as the destination. Server-side encryption is enabled using an AWS KMS CMK, and destination error logging has been enabled as per best practices.
  • Amazon SES configuration – A configuration set in Amazon SES that is used to map Kinesis Data Firehose as the event destination to publish email metrics.

To use the configuration set when sending emails, you can specify a default configuration set for your verified identity, or include a reference to the configuration set in the headers of the email.

  • Exploring and analyzing the data – We use Amazon Redshift query editor v2 for exploring and analyzing the data.
  • Alarms and notifications for ingestion failures – A data load error notification system using CloudWatch and Amazon SNS generates email-based notifications in the event of a failure during data load from Kinesis Data Firehose to Amazon Redshift. The setup creates a CloudWatch log metric filter, as shown in the following screenshot.

A CloudWatch alarm based on the metric filter triggers an SNS notification when in alarm state. For more information, see Using Amazon CloudWatch alarms.

Deploy the CloudFormation template

The provided CloudFormation template automatically creates all the required resources for this solution in your AWS account. For more information, see Getting started with AWS CloudFormation.

  1. Sign in to the AWS Management Console.
  2. Choose Launch Stack to launch AWS CloudFormation in your AWS account:
  3. For Stack name, enter a meaningful name for the stack, for example, ses_events.
  4. Provide the following values for the stack parameters:
    1. ClusterName – The name of the Amazon Redshift cluster.
    2. DatabaseName – The name of the first database to be created when the Amazon Redshift cluster is created.
    3. DeliveryStreamName – The name of the Firehose delivery stream.
    4. MasterUsername – The user name that is associated with the primary user account for the Amazon Redshift cluster.
    5. NodeType – The type of node to be provisioned. (Default dc2.large)
    6. NotificationEmailId – The email notification list that is used to configure an SNS topic for sending CloudWatch alarm and event notifications.
    7. NumberofNodes – The number of compute nodes in the Amazon Redshift cluster. For multi-node clusters, the NumberofNodes parameter must be greater than 1.
    8. OnPremisesCIDR – IP range (CIDR notation) for your existing infrastructure to access the target and replica Amazon Redshift clusters.
    9. SESConfigSetName – Name of the Amazon SES configuration set.
    10. SubnetId – Subnet ID where source Amazon Redshift cluster is created.
    11. Vpc – VPC in which Amazon Redshift cluster is launched.
  5. Choose Next.
  6. Review all the information and select I acknowledge that AWS CloudFormation might create IAM resources.
  7. Choose Create stack.

You can track the progress of the stack creation on the Events tab. Wait for the stack to complete and show the status CREATE_COMPLETE.

Test the solution

To send a test email, we use the Amazon SES mailbox simulator. Set the configuration-set header to the one created by the CloudFormation template.

We use the Amazon Redshift query editor V2 to query the Amazon Redshift table (created by the CloudFormation template) and see if the events have shown up.

If the data load of the event stream fails from Kinesis Data Firehose to Amazon Redshift, the failure notification system is triggered, and you receive an email notification via Amazon SNS.

Clean up

Some of the AWS resources deployed by the CloudFormation stacks in this post incur a cost as long as you continue to use them.

You can delete the CloudFormation stack to delete all AWS resources created by the stack. To clean up all your stacks, use the AWS CloudFormation console to remove the stacks that you created in reverse order.

  1. On the Stacks page on the AWS CloudFormation console, choose the stack to delete.
  2. In the stack details pane, choose Delete.
  3. Choose Delete stack when prompted.

After stack deletion begins, you can’t stop it. The stack proceeds to the DELETE_IN_PROGRESS state. When the stack deletion is complete, the stack changes to the DELETE_COMPLETE state. The AWS CloudFormation console doesn’t display stacks in the DELETE_COMPLETE state by default. To display deleted stacks, you must change the stack view filter. For more information, see Viewing deleted stacks on the AWS CloudFormation console.

If the delete fails, the stack enters the DELETE_FAILED state. For solutions, see Delete stack fails.

Conclusion

In this post, we walked through the process of setting up Amazon SES and Amazon Redshift to deploy an email reporting service that can scale to support millions of events. We used Amazon Redshift to store semi-structured messages using the SUPER data type in database tables to support varying message sizes and formats. With this solution, you can easily run analytics at scale and analyze your email event data for deliverability-related issues such as bounces or complaints.

Use the CloudFormation template provided to speed up provisioning of the cloud resources required for the solution (Amazon SES, Kinesis Data Firehose, and Amazon Redshift) in your account while following security best practices. Then you can analyze Amazon SES events at scale using Amazon Redshift.

About the Authors

Manash Deb is a Software Development Engineer in the AWS Directory Service team. He has worked on building end-to-end applications in different database and technologies for over 15 years. He loves to learn new technologies and solving, automating, and simplifying customer problems on AWS.

Arnab Ghosh is a Solutions Architect for AWS in North America helping enterprise customers build resilient and cost-efficient architectures. He has over 13 years of experience in architecting, designing, and developing enterprise applications solving complex business problems.

Sanjoy Thanneer is a Sr. Technical Account Manager with AWS based out of New York. He has over 20 years of experience working in Database and Analytics Domains.  He is passionate about helping enterprise customers build scalable , resilient and cost efficient Applications.

Justin Morris is a Email Deliverability Manager for the Simple Email Service team. With over 10 years of experience in the IT industry, he has developed a natural talent for diagnosing and resolving customer issues and continuously looks for growth opportunities to learn new technologies and services.

Watching Eurovision 2022 on Cloudflare Radar

Post Syndicated from João Tomé original https://blog.cloudflare.com/watching-eurovision-2022-on-cloudflare-radar/

Watching Eurovision 2022 on Cloudflare Radar

Watching Eurovision 2022 on Cloudflare Radar

The Eurovision Song Contest has a history that goes back to 1956, so it’s even older than the European Union and one of its highlights over the years was being the first global stage for the Swedish group ABBA — Waterloo won the 1974 edition). This year, for the 66th edition, we have a dedicated page for Eurovision fans, journalists or anyone interested in following Internet trends related to the event taking place in Turin, Italy.

The contest consists of two semi-finals and a final. The first semi-final is today, May 10, at 21:00 CEST, the second is Thursday, May 12, at 21:00 CEST. And the final is on Saturday, May 14, at 21:00 CEST. We are using Central European Summer Time and not our usual (on Radar) UTC because that’s the timezone of most of the 40 countries that will take part in the contest. There will be 17 countries in the first semi-final, 18 in the second, and 25 in the final (the full list is here).

From countries to fan sites.

First, you can see the Internet traffic aggregate in all the 40 countries that are participating in Eurovision 2022. There’s also a toggle to choose each of the 40 countries regarding Internet traffic. If you pass the mouse over the traffic line, the traffic level hour by hour is also highlighted.

Watching Eurovision 2022 on Cloudflare Radar

Then, we use DNS name resolution data to estimate traffic from the 40 participating countries to several types of websites. We have a video platforms chart as Eurovision has content on major video platforms. The baseline for the values we use is the average of the previous week, represented in the charts.

Watching Eurovision 2022 on Cloudflare Radar

We also show social media trends in the participating countries, by hour, to see if the Eurovision semi-finals and final cause a change.

The contest has a large base of fan websites (there’s even the OGAE, General Organisation of Eurovision Fans), and we also have a chart for Eurovision fan sites. In this chart, yesterday at 20:00 CEST, traffic was already at its highest since May 1, with 6.22x more than the average of the previous week (that’s the baseline here).

Watching Eurovision 2022 on Cloudflare Radar

Last, but not least, we also show the impact on national official broadcasters’ websites from the participating countries. For all the charts, there’s a download button to save the image file like this:

Watching Eurovision 2022 on Cloudflare Radar

For this evening’s first semi-final, Portugal is participating and since we’re writing this blog post from our Lisbon office, I asked everyone’s favorite songs for the 2022 Eurovision edition. Norway’s song from Subwoolfer, Give That Wolf A Banana, was one of the favorites, followed by Portugal’s song from MARO, Saudade, Saudade.

The UK’s song from Sam Ryder, SPACE MAN, is automatically in Saturday’s final and was also praised at the Lisbon office, the same with France’s song from Alvan & Ahez, called Fulenn, where the group sings in their native language, Breton (from the French region of Brittany).

Besides our dedicated Eurovision page, radar.cloudflare.com/eurovision-2022, we will also be checking this week for some trends on Cloudflare Radar’s Twitter account. Let the songs (and the Internet trends) begin.

The collective thoughts of the interwebz

Proudly powered by Ants