Security updates for Wednesday

Post Syndicated from original https://lwn.net/Articles/894802/

Security updates have been issued by Debian (mutt), Fedora (blender, freerdp, kernel, kernel-headers, kernel-tools, mingw-freetype, and vim), Oracle (kernel and kernel-container), Red Hat (aspell, bind, bluez, c-ares, cairo and pixman, cockpit, compat-exiv2-026, container-tools:3.0, container-tools:rhel8, cpio, dovecot, exiv2, fapolicyd, fetchmail, flatpak, gfbgraph, gnome-shell, go-toolset:rhel8, grafana, grub2, httpd:2.4, keepalived, kernel, kernel-rt, libpq, libreoffice, libsndfile, libssh, libtiff, lynx, maven:3.5, maven:3.6, mod_auth_mellon, mod_auth_openidc:2.3, openssh, php:7.4, pki-core:10.6, postgresql:10, python-lxml, python27:2.7, python3, python38:3.8 python38-devel:3.8, python39:3.9 python39-devel:3.9, qt5-qtbase, qt5-qtsvg, rust-toolset:rhel8, samba, squid:4, udisks2, virt:rhel virt-devel:rhel, webkit2gtk3, xorg-x11-server xorg-x11-server-Xwayland, and zsh), SUSE (gzip and php-composer), and Ubuntu (busybox, cairo, cron, dnsmasq, libsndfile, and nss).

Announcing D1: our first SQL database

Post Syndicated from Rita Kozlov original https://blog.cloudflare.com/introducing-d1/

Announcing D1: our first SQL database

Announcing D1: our first SQL database

We announced Cloudflare Workers in 2017, giving developers access to compute on our network. We were excited about the possibilities this unlocked, but we quickly realized — most real world applications are stateful. Since then, we’ve delivered KV, Durable Objects, and R2, giving developers access to various types of storage.

Today, we’re excited to announce D1, our first SQL database.

While the wait on beta access shouldn’t be long — we’ll start letting folks in as early as June (sign up here), we’re excited to share some details of what’s to come.

Meet D1, the database designed for Cloudflare Workers

D1 is built on SQLite. Not only is SQLite the most ubiquitous database in the world, used by billions of devices a day, it’s also the first ever serverless database. Surprised? SQLite was so ahead of its time, it dubbed itself “serverless” before the term gained connotation with cloud services, and originally meant literally “not involving a server”.

Since Workers itself runs between the server and the client, and was inspired by technology built for the client, SQLite seemed like the perfect fit for our first entry into databases.

So what can you build with D1? The true answer is “almost anything!”, that might not be very helpful in triggering the imagination, so how about a live demo?

D1 Demo: Northwind Traders

You can check out an example of D1 in action by trying out our demo running here: northwind.d1sql.com.

If you’re wondering “Who are Northwind Traders?”, Northwind Traders is the “Hello, World!” of databases, if you will. A sample database that Microsoft would provide alongside Microsoft Access to use as their own tutorial. It first appeared 25 years ago in 1997, and you’ll find many examples of its use on the Internet.

It’s a typical business application, with a realistic schema, with many foreign keys, across many different tables — a truly timeless representation of data.

Announcing D1: our first SQL database

When was the recent order of Queso Cabrales shipped, and what ship was it on? You can quickly find out. Someone calling in about ordering some Chai? Good thing Exotic Liquids still has 39 units in stock, for just \$18 each.

Announcing D1: our first SQL database

We welcome you to play and poke around, and answer any questions you have about Northwind Trading’s business.

The Northwind Traders demo also features a dashboard where you can find details and metrics about the D1 SQL queries happening behind the scenes.

Announcing D1: our first SQL database

What can you build with D1?

Going back to our original question before the demo, however, what can you build with D1?

While you may not be running Northwind Traders yourself, you’re likely running a very similar piece of software somewhere. Even at the very core of Cloudflare’s service is a database. A SQL database filled with tables, materialized views and a plethora of stored procedures. Every time a customer interacts with our dashboard they end up changing state in that database.

The reality is that databases are everywhere. They are inside the web browser you’re reading this on, inside every app on your phone, and the storage for your bank transaction, travel reservations, business applications, and on and on. Our goal with D1 is to help you build anything from APIs to rich and powerful applications, including eCommerce sites, accounting software, SaaS solutions, and CRMs.

You can even combine D1 with Cloudflare Access and create internal dashboards and admin tools that are securely locked to only the people in your organization. The world, truly, is your oyster.

The D1 developer experience

We’ll talk about the capabilities, and upcoming features further down in the post, but at the core of it, the strength of D1 is the developer experience: allowing you to go from nothing to a full stack application in an instant. Think back to a tool you’ve used that made development feel magical — that’s exactly what we want developing with Workers and D1 to feel like.

To give you a sense of it, here’s what getting started with D1 will look like.

Creating your first D1 database

With D1, you will be able to create a database, in just a few clicks — define the tables, insert or upload some data, no need to memorize any commands unless you need to.

Announcing D1: our first SQL database

Of course, if the command-line is your jam, earlier this week, we announced the new and improved Wrangler 2, the best tool for wrangling and deploying your Workers, and soon also your tool for deploying D1. Wrangler will also come with native D1 support, so you can create & manage databases with a few simple commands:

Accessing D1 from your Worker

Attaching D1 to your Worker is as easy as creating a new binding. Each D1 database that you attach to your Worker gets attached with its own binding on the env parameter:

export default {
  async fetch(request, env, ctx) {
    const { pathname } = new URL(request.url)
    if (pathname === '/num-products') {
      const { result } = await env.DB.get(`SELECT count(*) AS num_products FROM Product;`)
      return new Response(`There are ${result.num_products} products in the D1 database!`)
    }
  }
}

Or, for a slightly more complex example, you can safely pass parameters from the URL to the database using a Router and parameterised queries:

import { Router } from 'itty-router';
const router = Router();

router.get('/product/:id', async ({ params }, env) => {
  const { result } = await env.DB.get(
    `SELECT * FROM Product WHERE ID = $id;`,
    { $id: params.id }
  )
  return new Response(JSON.stringify(result), {
    headers: {
      'content-type': 'application/json'
    }
  })
})

export default {
  fetch: router.handle,
}

So what can you expect from D1?

First and foremost, we want you to be able to develop with D1, without having to worry about cost.

At Cloudflare, we don’t believe in keeping your data hostage, so D1, like R2, will be free of egress charges. Our plan is to price D1 like we price our storage products by charging for the base storage plus database operations performed.

But, again, we don’t want our customers worrying about the cost or what happens if their business takes off, and they need more storage or have more activity. We want you to be able to build applications as simple or complex as you can dream up. We will ensure that D1 costs less and performs better than comparable centralized solutions. The promise of serverless and a global network like Cloudflare’s is performance and lower cost driven by our architecture.

Here’s a small preview of the features in D1.

Read replication

With D1, we want to make it easy to store your whole application’s state in the one place, so you can perform arbitrary queries across the full data set. That’s what makes relational databases so powerful.

However, we don’t think powerful should be synonymous with cumbersome. Most relational databases are huge, monolithic things and configuring replication isn’t trivial, so in general, most systems are designed so that all reads and writes flow back to a single instance. D1 takes a different approach.

With D1, we want to take configuration off your hands, and take advantage of Cloudflare’s global network. D1 will create read-only clones of your data, close to where your users are, and constantly keep them up-to-date with changes.

Batching

Many operations in an application don’t just generate a single query. If your logic is running in a Worker near your user, but each of these queries needs to execute on the database, then sending them across the wire one-by-one is extremely inefficient.

D1’s API includes batching: anywhere you can send a single SQL statement you can also provide an array of them, meaning you only need a single HTTP round-trip to perform multiple operations. This is perfect for transactions that need to execute and commit atomically:

async function recordPurchase(userId, productId, amount) { 
  const result = await env.DB.exec([
    [
      `UPDATE users SET balance = balance - $amount WHERE user_id = $user_id`,
      { $amount: amount, $user_id: userId },
    ],
    [
      'UPDATE product SET total_sales = total_sales + $amount WHERE product_id = $product_id',
      { $amount: amount, $product_id: productId },
    ],
  ])
  return result
}

Embedded compute

But we’re going further. With D1, it will be possible to define a chunk of your Worker code that runs directly next to the database, giving you total control and maximum performance—each request first hits your Worker near your users, but depending on the operation, can hand off to another Worker deployed alongside a replica or your primary D1 instance to complete its work.

Backups and redundancy

There are few things as critical as the data stored in your main application’s database, so D1 will automatically save snapshots of your database to Cloudflare’s cloud storage service, R2, at regular intervals, with a one-click restoration process. And, since we’re building on the redundant storage of Durable Objects, your database can physically move locations as needed, resulting in self-healing from even the most catastrophic problems in seconds.

Importing and exporting data

While D1 already supports the SQLite API, making it easy for you to write your queries, you might also need data to run them on. If you’re not creating a brand-new application, you may want to import an existing dataset from another source or database, which is why we’ll be working on allowing you to bring your own data to D1.

Likewise, one of SQLite’s advantages is its portability. If your application has a dedicated staging environment, say, you’ll be able to clone a snapshot of that data down to your local machine to develop against. And we’ll be adding more flexibility, such as the ability to create a new database with a set of test data for each new pull request on your Pages project.

What’s next?

This wouldn’t be a Cloudflare announcement if we didn’t conclude on “we’re just getting started!” — and it’s true! We are really excited about all the powerful possibilities our database on our global network opens up.

Are you already thinking about what you’re going to build with D1 and Workers? Same. Give us your details, and we’ll give you access as soon as we can — look out for a beta invite from us starting as early as June 2022!

Logs on R2: slash your logging costs

Post Syndicated from Tanushree Sharma original https://blog.cloudflare.com/logs-r2/

Logs on R2: slash your logging costs

Logs on R2: slash your logging costs

Hot on the heels of the R2 open beta announcement, we’re excited that Cloudflare enterprise customers can now use Logpush to store logs on R2!

Raw logs from our products are used by our customers for debugging performance issues, to investigate security incidents, to keep up security standards for compliance and much more. You shouldn’t have to make tradeoffs between keeping logs that you need and managing tight budgets. With R2’s low costs, we’re making this decision easier for our customers!

Getting into the numbers

Cloudflare helps customers at different levels of scale — from a few requests per day, up to a million requests per second. Because of this, the cost of log storage also varies widely. For customers with higher-traffic websites, log storage costs can grow large, quickly.

As an example, imagine a website that gets 100,000 requests per second. This site would generate about 9.2 TB of HTTP request logs per day, or 850 GB/day after gzip compression. Over a month, you’ll be storing about 26 TB (compressed) of HTTP logs.

For a typical use case, imagine that you write and read the data exactly once – for example, you might write the data to object storage before ingesting it into an alerting system. Compare the costs of R2 and S3 (note that this excludes costs per operation to read/write data).

Provider Storage price Data transfer price Total cost assuming data is read once
R2 $0.015/GB $0 $390/month
S3 (Standard, US East $0.023/GB $0.09/GB for first 10 TB; then $0.085/GB $2,858/month

In this example, R2 leads to 86% savings! It’s worth noting that querying logs is where another hefty price tag comes in because Amazon Athena charges based on the amount of data scanned. If your team is looking back through historical data, each query can be hundreds of dollars.

Many of our customers have tens to hundreds of domains behind Cloudflare and the majority of our Enterprise customers also use multiple Cloudflare products. Imagine how costs will scale if you need to store HTTP, WAF and Spectrum logs for all of your Internet properties behind Cloudflare.

For SaaS customers that are building the next big thing on Cloudflare, logs are important to get visibility into customer usage and performance. Your customer’s developers may also want access to raw logs to understand errors during development and to troubleshoot production issues. Costs for storing logs multiply and add up quickly!

The flip side: log retrieval

When designing products, one of Cloudflare’s core principles is ease of use. We take on the complexity, so you don’t have to. Storing logs is only half the battle, you also need to be able to access relevant logs when you need them – in the heat of an incident or when doing an in depth analysis.

Our product, Logpull, offers seven days of log retention and an easy to use API to access. Our customers love that Logpull doesn’t need any setup on third parties since it’s completely managed by Cloudflare. However, Logpull is limited in the retention of logs, the type of logs that we store (only HTTP request logs) and the amount of data that can be queried at one time.

We’re building tools for log retrieval that make it super easy to get your data out of R2 from any of our datasets. Similar to Logpull, we’ll start by supporting lookups by time period and rayId. From there, we’ll tackle more complex functions like returning logs within time X and Y that have 500 errors or where WAF action = block.

We’re looking for customers to join a closed beta for our Log Retrieval API. If you’re interested in testing it out, giving feedback and ultimately helping us shape the product sign up here.

Logs on R2: How to get started

Enterprise customers first need to get R2 added to their contract. Reach out to your account team if this is something you’re interested in! Once enabled, create an R2 bucket for your logs and follow the Logpush setup flow to create your job.

Logs on R2: slash your logging costs

It’s that simple! If you have questions, our Logpush to R2 developer docs go into more detail.

More to come

We’re continuing to build out more advanced Logpush features with a focus on customization. Here’s a preview of what’s next on the roadmap:

  • New datasets: Network Analytics Logs, Workers Invocation Logs
  • Log filtering
  • Custom log formatting

We also have exciting plans to build out log analysis and forensics capabilities on top of R2. We want to make log storage tightly coupled to the Cloudflare dash so you can see high level analytics and drill down into individual log lines all in one view. Stay tuned to the blog for more!

Introducing Cache Reserve: massively extending Cloudflare’s cache

Post Syndicated from Alex Krivit original https://blog.cloudflare.com/introducing-cache-reserve/

Introducing Cache Reserve: massively extending Cloudflare’s cache

Introducing Cache Reserve: massively extending Cloudflare’s cache

One hundred percent. 100%. One-zero-zero. That’s the cache ratio we’re all chasing. Having a high cache ratio means that more of a website’s content is served from a Cloudflare data center close to where a visitor is requesting the website. Serving content from Cloudflare’s cache means it loads faster for visitors, saves website operators money on egress fees from origins, and provides multiple layers of resiliency and protection to make sure that content is always available to be served.

Today, I’m delighted to announce a massive extension of the benefits of caching with Cache Reserve: a new way to persistently serve all static content from Cloudflare’s global cache. By using Cache Reserve, customers can see higher cache hit ratios and lower egress bills.

Why is getting a 100% cache ratio difficult?

Every second, Cloudflare serves tens-of-millions of requests from our cache which equates to multiple terabytes-per-second of cached data being delivered to website visitors around the world. With this massive scale, we must ensure that the most requested content is cached in the areas where it is most popular. Otherwise, visitors might wait too long for content to be delivered from farther away and our network would be running inefficiently. If cache storage in a certain region is full, our network avoids imposing these inefficiencies on our customers by evicting less-popular content from the data center and replacing it with more-requested content.

This works well for the majority of use cases, but all customers have long tail content that is rarely requested and may be evicted from cache. This can be a cause of concern for customers, as this unpopular content can be a major cost driver if it is evicted repeatedly and needs to be served from an origin. This concern can be especially significant for customers with massive content libraries. So how can we make sure to keep this less popular content in cache to shield the customer from origin egress?

Cache Reserve removes customer content from this popularity contest and ensures that even if the specific content hasn’t been requested in months, it can still be served from Cloudflare’s cache – avoiding the need to pull it from the origin and saving the customer money on egress. Cache Reserve helps get customers closer to that 100% cache ratio and helps serve all of their content from our global CDN, forever.  

Why is cache eviction needed?

Most content served from our cache starts its journey from an origin server – where content is hosted. In order to be admitted to Cloudflare’s cache the content sent from the origin must meet certain eligibility criteria that ensures it can be reused to respond to other requests for a website (content that doesn’t change based on who is visiting the site).

After content is admitted to cache, the next question to consider is how long it should remain in cache. Since cache ratios are calculated by taking the number of requests for content and identifying the portion that are answered from a cache server instead of an origin server, ensuring content remains cached in an area it is highly requested is paramount to achieving a high cache ratio.

Introducing Cache Reserve: massively extending Cloudflare’s cache

Some CDNs use a pay-to-play model that allows customers to pay more money to ensure content is cached in certain areas for some length of time. At Cloudflare, we don’t charge customers based on where or for how long something is cached. This means that we have to use signals other than a customer’s willingness to pay to make sure that the right content is cached for the right amount of time and in the right areas.

Where to cache a piece of content is pretty straightforward (where it’s being requested), how long content should remain in cache can be highly variable.

Beyond headers like cache-control or cdn-cache-control, which help determine how long a customer wants something to be served from cache, the other element that CDNs must consider is whether they need to evict content early to optimize storage of more popular assets. We do eviction based on an algorithm called “least recently used” or LRU. This means that the least-requested content can be evicted from cache first to make space for more popular content when storage space is full.

This caching strategy requires keeping track of a lot of information about when requests come in and constantly updating the cache to make sure that the hottest content is kept in cache and the least popular content is evicted. This works well and is fair for the wide-array of customers our CDN supports.

However, if a customer has a large library of content that might go through cycles of popularity and which they’d like to serve from cache regardless, then LRU might mean additional origin egress as assets that are requested sparingly over a long time frame are pulled more from the origin.    

That’s where Cache Reserve comes in. Cache Reserve is not an alternative to our popularity-based cache but a complement to it. By backstopping all cacheable content in Cache Reserve customers don’t have to worry about cache eviction or ephemerality any longer.    

Cache Reserve

Cache Reserve is a large, persistent data store that is implemented on top of R2. By pushing a single button in the dashboard, all of your website’s cacheable content will be written to Cache Reserve. In the same way that Tiered Cache builds a hierarchy of caches between your visitors and your origin, Cache Reserve serves as the ultimate upper-tier cache that will reserve storage space for your assets for as long as you want. This ensures that your content is always served from cache, shielding your origin from unneeded egress fees, and improving response performance.

How Does Cache Reserve Work?

Introducing Cache Reserve: massively extending Cloudflare’s cache

Cache Reserve sits between our edge data centers and your origin and provides guaranteed SLAs for how long your content can remain in cache.

As content is pulled from the origin, it will be written to Cache Reserve, followed by upper-tier data centers, and lower-tier data centers until it reaches the client to fulfill the request. Subsequent requests for the same content will not need to go all the way back to the origin for the response and can, instead, be served from a cache closer to the visitor. Improving both performance and costs of serving the assets. As content gets evicted from lower-tiers and upper-tiers, it will be backstopped by Cache Reserve.

Cache Reserve voids the request-based eviction that’s implemented in LRU and ensures that assets will remain in cache as long as they are needed. Cache Reserve extends the benefits of Tiered Cache by reducing the number of times Cloudflare’s network needs to ask an origin for content we should have in cache, while simultaneously limiting the number of connections and requests that our data centers need to open to your origin to ask for missing content. Using Cache Reserve with tiered cache helps collapse the number of requests that result from multiple concurrent cache misses from lower-tiers for the same content.

As an example, let’s assume a cold request for example.com, something our network has never seen before. If a client request comes into the closest lower-tier data center and it is a miss, that lower-tier is mapped to an upper-tier data center. When the lower-tier asks the upper-tier for the content and it is also a miss, the upper-tier will ask Cache Reserve for the content. Now, being the ultimate upper-tier, it will be the only data center that can ask the origin for content if it is not stored on our network. This will help limit the origin resources you need to devote to serving this content as once it’s written to Cache Reserve, your origin doesn’t need to fan out the content to any other part of Cloudflare’s network.

When your content does need updating, Cache Reserve will respect cache-control headers and purge requests. This means that if you want to control how long something remains fresh in Cache Reserve, before Cloudflare goes back to your origin to revalidate the content, set it as a cache-control header and it will be respected without risk of early eviction. Or if you want to update content on the fly, you can send a purge request which will be respected in both Cloudflare’s cache and in Cache Reserve.

How do you use Cache Reserve?

Currently, Cache Reserve is in closed beta, meaning that it’s available to anyone who wants to sign up but we will be slowly rolling it out to customers over the coming weeks to make sure that we are quickly triaging edge cases and making fundamental improvements before we make it generally available to everyone.

To sign up for the Cache Reserve beta:

  • Simply go to the Caching tile in the dashboard.
  • Navigate to the Cache Reserve page and push the sign up button.
Introducing Cache Reserve: massively extending Cloudflare’s cache

The Cache Reserve Plan will mimic the low cost of R2. Storage will be \$0.015 per GB per month and operations will be \$0.36 per million reads, and \$4.50 per million writes. For more information about pricing, please refer to the R2 page to get a general idea (Cache Reserve pricing page will be out soon).  

Try it out!

Cache Reserve holds tremendous promise to increase cache hit ratios — which will improve the economics of running any website while speeding up visitors’ experiences. We’re excited to begin letting people use Cache Reserve soon. Be sure to check out the beta and let us know what you think.

Durable Objects Alarms — a wake-up call for your applications

Post Syndicated from Matt Alonso original https://blog.cloudflare.com/durable-objects-alarms/

Durable Objects Alarms — a wake-up call for your applications

Durable Objects Alarms — a wake-up call for your applications

Since we launched Durable Objects, developers have leveraged them as a novel building block for distributed applications.

Durable Objects provide globally unique instances of a JavaScript class a developer writes, accessed via a unique ID. The Durable Object associated with each ID implements some fundamental component of an application — a banking application might have a Durable Object representing each bank account, for example. The bank account object would then expose methods for incrementing a balance, transferring money or any other actions that the application needs to do on the bank account.

Durable Objects work well as a stateful backend for applications — while Workers can instantiate a new instance of your code in any of Cloudflare’s data centers in response to a request, Durable Objects guarantee that all requests for a given Durable Object will reach the same instance on Cloudflare’s network.

Each Durable Object is single-threaded and has access to a stateful storage API, making it easy to build consistent and highly-available distributed applications on top of them.

This system makes distributed systems’ development easier — we’ve seen some impressive applications launched atop Durable Objects, from collaborative whiteboarding tools to conflict-free replicated data type (CRDT) systems for coordinating distributed state launch.

However, up until now, there’s been a piece missing — how do you invoke a Durable Object when a client Worker is not making requests to it?

As with any distributed system, Durable Objects can become unavailable and stop running. Perhaps the machine you were running on was unplugged, or the datacenter burned down and is never coming back, or an individual object exceeded its memory limit and was reset. Before today, a subsequent request would reinitialize the Durable Object on another machine, but there was no way to programmatically wake up an Object.

Durable Objects Alarms are here to change that, unlocking new use cases for Durable Objects like queues and deferred processing.

What is a Durable Object Alarm?

Durable Object Alarms allow you, from within your Durable Object, to schedule the object to be woken up at a time in the future. When the alarm’s scheduled time comes, the Durable Object’s alarm() handler will be called. If this handler throws an exception, the alarm will be automatically retried using exponential backoff until it succeeds — alarms have guaranteed at-least-once execution.

How are Alarms different from Workers Cron Triggers?

Alarms are more fine-grained than Cron Triggers. While a Workers service can have up to three Cron Triggers configured at once, it can have an unlimited amount of Durable Objects, each of which can have a single alarm active at a time.

Alarms are directly scheduled from and invoke a function within your Durable Object. Cron Triggers, on the other hand, are not programmatic — they execute based on their schedules, which have to be configured via the Cloudflare Dashboard or centralized configuration APIs.

How do I use Alarms?

First, you’ll need to add the durable_object_alarms compatibility flag to your wrangler.toml.

compatibility_flags = ["durable_object_alarms"]

Next, implement an alarm() handler in your Durable Object that will be called when the alarm executes. From anywhere else in your Durable Object, call state.storage.setAlarm() and pass in a time for the alarm to run at. You can use state.storage.getAlarm() to retrieve the currently set alarm time.

In this example, we implemented an alarm handler that wakes the Durable Object up once every 10 seconds to batch requests to a single Durable Object, deferring processing until there is enough work in the queue for it to be worthwhile to process them.

export default {
  async fetch(request, env) {
    let id = env.BATCHER.idFromName("foo");
    return await env.BATCHER.get(id).fetch(request);
  },
};

const SECONDS = 1000;

export class Batcher {
  constructor(state, env) {
    this.state = state;
    this.storage = state.storage;
    this.state.blockConcurrencyWhile(async () => {
      let vals = await this.storage.list({ reverse: true, limit: 1 });
      this.count = vals.size == 0 ? 0 : parseInt(vals.keys().next().value);
    });
  }
  async fetch(request) {
    this.count++;

    // If there is no alarm currently set, set one for 10 seconds from now
    // Any further POSTs in the next 10 seconds will be part of this kh.
    let currentAlarm = await this.storage.getAlarm();
    if (currentAlarm == null) {
      this.storage.setAlarm(Date.now() + 10 * SECONDS);
    }

    // Add the request to the batch.
    await this.storage.put(this.count, await request.text());
    return new Response(JSON.stringify({ queued: this.count }), {
      headers: {
        "content-type": "application/json;charset=UTF-8",
      },
    });
  }
  async alarm() {
    let vals = await this.storage.list();
    await fetch("http://example.com/some-upstream-service", {
      method: "POST",
      body: Array.from(vals.values()),
    });
    await this.storage.deleteAll();
    this.count = 0;
  }
}

Once every 10 seconds, the alarm() handler will be called. In the event an unexpected error terminates the Durable Object, it will be re-instantiated on another machine, following a short delay, after which it can continue processing.

Under the hood, Alarms are implemented by making reads and writes to the storage layer. This means Alarm get and set operations follow the same rules as any other storage operation – writes are coalesced with other writes, and reads have a defined ordering. See our blog post on the caching layer we implemented for Durable Objects for more information.

Durable Objects Alarms guarantee fault-tolerance

Alarms are designed to have no single point of failure and to run entirely on our edge – every Cloudflare data center running Durable Objects is capable of running alarms, including migrating Durable Objects from unhealthy data centers to healthy ones as necessary to ensure that their Alarm executes. Single failures should resolve in under 30 seconds, while multiple failures may take slightly longer.

We achieve this by storing alarms in the same distributed datastore that backs the Durable Object storage API. This allows alarm reads and writes to behave identically to storage reads and writes and to be performed atomically with them, and ensures that alarms are replicated across multiple datacenters.

Within each data center capable of running Durable Objects, there are multiple processes responsible for tracking upcoming alarms and triggering them, providing fault tolerance and scalability within the data center. A single elected leader in each data center is responsible for detecting failure of other data centers and assigning responsibility of those alarms to healthy local processes in its own data center. In the event of leader failure, another leader will be elected and become responsible for executing Alarms in the data center. This allows us to guarantee at-least-once execution for all Alarms.

How do I get started?

Alarms are a great way to build new distributed primitives, like queues, atop Durable Objects. They also provide a method for guaranteeing work within a Durable Object will complete, without relying on a client request to “kick” the Object.

You can get started with Alarms now by enabling Durable Objects in the Cloudflare dashboard. For more info, check the developer docs or jump in our Discord.

A New Hope for Object Storage: R2 enters open beta

Post Syndicated from Greg McKeon original https://blog.cloudflare.com/r2-open-beta/

A New Hope for Object Storage: R2 enters open beta

A New Hope for Object Storage: R2 enters open beta

In September, we announced that we were building our own object storage solution: Cloudflare R2. R2 is our answer to egregious egress charges from incumbent cloud providers, letting developers store as much data as they want without worrying about the cost of accessing that data.

The response has been overwhelming.

  • Independent developers had bills too small for cloud providers to negotiate fair egress rates with them. Egress charges were the largest line-item on their cloud bills, strangling side projects and the new businesses they were building.
  • Large corporations had written off multi-cloud storage – and thus multi-cloud itself – as a pipe dream. They came to us with excitement, pitching new products that integrated data with partner companies.
  • Non-profit research organizations were paying massive egress fees just to share experiment data with one another. Egress fees were having a real impact on their ability to collaborate, driving silos between organizations and restricting the experiments and analyses they could run.

Cloudflare exists to help build a better Internet. Today, the Internet gets what it deserves: R2 is now in open beta.

Self-serve customers can enable R2 in the Cloudflare dashboard. Enterprise accounts can reach out to their CSM for onboarding.

Internal and external APIs

R2 has two APIs: an API accessible only from within Workers, which we call the In-Worker API, and an S3-compatible API, which exposes your bucket on a URL of the form bucket.account.r2storage.com. Before you can make requests to R2, you’ll need to be authenticated — R2 buckets are private by default.

In-Worker API

With the in-Worker API, a bucket is “bound” to a specific Worker, which can then perform PUT, GET, DELETE and LIST operations against the bucket.

S3-compatible API

For the S3-compatible API, authentication is done the same way as on S3: SigV4 against an R2 URL. SigV4 signs requests using a secret key to authenticate them to R2. This means public access to R2 over the Internet is only possible today by hosting a Worker, connecting it to R2, and routing requests through it.

The easiest way to test the S3-compatible API is to use an S3 client. One of the most popular S3 clients is the boto3 SDK.

In Python, copy the following script and fill in the account_id, access_key, and secret_access_key fields with your R2 account credentials.

#!/usr/bin/env python
import boto3
import pprint
from botocore.client import Config
 
account_id = ''
access_key_id = ''
secret_access_key = ''
endpoint = f'https://{account_id}.r2.cloudflarestorage.com'
 
cl = boto3.client(
    's3',
    aws_access_key_id=access_key_id,
    aws_secret_access_key=secret_access_key,
    endpoint_url=endpoint,
    config=Config(
        region_name = endpoints[endpoint_name].get('region', 'auto'),
        s3={'addressing_style': 'path'},
        retries=dict( max_attempts=0 ),
    ),
)
 
printer = pprint.PrettyPrinter().pprint
 
printer(cl.head_bucket(Bucket='some bucket'))
printer(cl.create_bucket(Bucket='some other bucket'))
printer(cl.put_object(Bucket='some bucket', Key='my object', Body='some payload'))

Features

R2 comes with support for all basic create/read/update/delete S3 features through both of its APIs.

During the open beta period, we’re targeting R2 to sustain 1,000 GET operations per second and 100 PUT operations per second, per bucket. R2 supports objects up to approximately 5 TB in size, with individual parts limited to 5 GB of data.

R2 provides strongly consistent access to data. Once a PUT is confirmed by R2, future GET operations will always reflect the new key/value pair. The only exception to this is when deleting a bucket. For a short period of time following deletion, the bucket may still exist and continue to allow reads/writes.

Pricing

When we initially announced R2, we included preliminary pricing numbers. One of our main goals with R2 has been to serve the developers who can’t negotiate large discounts with cloud vendors. To that end, we’re also announcing a forever-free tier that lets developers start building on R2 with no charges at all.

R2 charges depend on the total volume of data stored and the type of operation performed on the data:

  • Storage is priced at \$0.015 / GB, per month.
  • Class A operations (including writes and lists) cost \$4.50 / million.
  • Class B operations cost \$0.36 / million.

Class A operations tend to mutate state, such as creating a bucket, listing objects in a bucket, or writing an object. Class B operations tend to read existing state, for example reading an object from a bucket. You can find more information on pricing and a full list of operation types in the docs.

Of course, there is no charge for egress bandwidth from R2. You can access your bucket to your heart’s content.

R2’s forever-free tier includes:

  • 10 GB-months of stored data
  • 1,000,000 Class A operations, per month
  • 10,000,000 Class B operations, per month

Free usage resets each month. While in the open beta phase, R2 usage over the free tier will be billed.

Future plans

We’ve spent the past six months in closed beta with a number of design partners, building out our storage solution. Backed by Durable Objects, R2’s novel architecture delivers both high availability and consistent performance.

While we’ve made great progress on R2, we still have plenty left to build in the coming months.

Improving performance

Our first priority is to improve performance and reliability. While we’ve thrown internal usage and our design partner’s demands at R2, there’s no substitute for live production traffic.

During the open beta period, R2 can sustain a maximum of 1,000 GET operations per second and 100 PUT operations per second, per bucket. We’ll look to raise these limits as we get comfortable operating the system. If you have higher needs, reach out to us!

When you create a bucket, you won’t see a region selector. Our vision for R2 includes automatically globally distributed storage, where R2 seamlessly places each object into the storage region closest to where the request comes from. Today, R2 primarily stores data in North America, which can lead to higher latencies when accessing content from other regions. We’ll first look to address this by adding additional regions where objects can be created, before adding automatic migration of existing objects across regions. Similar to what we’ve built with jurisdictional restrictions for Durable Objects, we’ll also enable restricting where an R2 bucket places data to comply with privacy regulations.

Expanding R2’s feature set

We’ll then focus on expanding R2 capabilities beyond the basic S3 API. In the near term, we’re focused on delivering:

  • Support for TTLs, so data can automatically be deleted from buckets over time.
  • Public buckets, so a bucket can be exposed to the internet without writing a Worker
  • Pre-signed URL support, which delegates read and write access for a specific key to a token.
  • Integration with Cloudflare’s cache, to scale read requests and provide global distribution of data.

If you have additional feature requests that aren’t listed above, we want to hear from you! Reach out and let us know what you need to make R2 your new, zero-cost egress object store.

So it’s been a while…

Post Syndicated from Adam Bradley original https://ibms360.co.uk/?p=902

Dear Reader,

Wow, it’s been a while since our last post here, almost 2 years! Time has totally flown by. I checked the traffic this morning and was pleasantly surprised to see that we’re still getting 2,000+ hits per month which is just incredible given that we haven’t published any updates.

So, I’m guessing you probably want to know whats going on and why we’re not posting here. Let me summarily answer your most important questions below:

  1. Are all of you okay? – Yes.
  2. Is the project dead? – No.
  3. Do you have any updates for us? – Unfortunately, not really.

So, the reason we haven’t been posting here is mainly because, well, nothing has changed. Chris & I have both been insanely busy with regular life, work is non-stop and personal commitments on top mean that currently we have little time to focus on the project. I’m additionally moving to Southampton for a new job which will put me further away from the project and will likely just add to the delay.

The small updates we do have for you are mainly administrative. Back in June 2020 Peter Vaughan purchased and donated some shelving units to the project to allow us to better store our parts, media, etc.

And in September of 2020 we had some members of the CCS (British Computer Conservation Society) visit us in a socially distanced fashion (remember that?!) to ask us some questions about the project following our application to join their projects register.

We have now successfully joined the CCS, and look forward to working with them in the future.

So, what of the project now? Well, for now we’ve basically decided to park the project for a while until one or both of us has more time to spend on it. It sucks because we really want to see the project move forward and succeed, but right now neither of us are particularly in a position to make that happen; and whilst we do have fantastic support from the rest of the team, realistically we need to be somewhat involved in order to be able to progress things in the direction we’d like them to go in.

So, basically we’re on pause for the moment. When will we be off pause? I don’t know. It depends on a lot of factors. Trust me though, if anything changes you will all be the first to hear about it!

All the best,

Adam

P.S. If you’ve sent us an email and we haven’t replied, I can only apologise. A lot of them seem to have disappeared into a black hole of our old email server, and so if you’d like to get in touch please send us another email and we’ll do our best to get back to you.

Federal Hearing about Rights under GPL

Post Syndicated from Bradley M. Kuhn original http://ebb.org/bkuhn/blog/2022/05/11/vizio-gpl-federal-hearing.html

[ This is
a crosspost
from my professional blog at Software Freedom Conservancy
(SFC)
. I encourage you
to use
that copy of the post as the canonical linkage for this essay — I
crossposted here merely for posterity and to reach a wider
audience. ]

Possible Opportunity for the Public To Hear Oral Arguments in Key GPL Enforcement Case

In our previous update regarding our copyleft
enforcement lawsuit against Vizio
, we talked about how Vizio
“removed” the case to USA federal court (namely, the Central
District of California), and how we filed a motion to “remand”
the case back to state court. While this all seems like minor legal
wrangling early in a case, this very first skirmish in our case goes to the
very heart of the right for software repair for consumers. While it won’t
be a final decision in the case, this motion will be the first indication
whether the federal courts view the GPL as purely a copyright license, or
as a contract, or as both. That question has been central to legal debate
about the GPL for decades, and, thanks to our case, for the first time, a
federal Court will directly consider this question.

Our view (and the view of many attorneys whose opinions we trust) and which is supported by substantial case law, is that the
GPL functions as both a copyright license and a contract, and that third
parties who receive distribution of GPL’d (and LGPL’d) software are
third-party beneficiaries. We’ve done both copyright-based and
contract-based enforcement, and both have their advantages. Contract-based enforcement as a third-party has advantages that are central to the GPL’s policy goals. Consumers are the first to discover violations in the first place. Consumers are the most likely to utilize complete, corresponding source code (CCS) to enhance their use of the products they have purchased. Third-party, contractual based enforcement gives consumers legal authority when they ask companies for access to the source code that should be available to them. In other words, this approach gives consumers the
ability to ask the Court directly for the most
important
thing that copyleft assures: a right to receive the
CCS and “the scripts used to control
compilation and installation of the executable”. Indeed, in our suit we have asked only for access to the source code, not for any money.

Our case
now is the first of its kind to adjudicate the third-party beneficiary
contractual theory. We are excited that a federal district Court is poised
to give its first answer to the central question to this endeavor, namely:
“Are the GPL and LGPL merely copyright licenses, and thus
preempted and only subject matter for the US federal courts, or can a
third-party bring a contract claim in state court?” If this
question intrigues you, we encourage you to read our motion
for remand
, Vizio’s reply to that motion
and our rebuttal reply.

Most importantly, clear your calendar for this Friday 13 May 2022 at 10:30
US/Pacific! While Judge Staton may chose to rule on this motion strictly
based on those paper filings, the judge has scheduled a hearing for
that date and time. What’s more, anyone in the world can attend this hearing to
listen! Instructions for how to
attend are
found on Judge Staton’s
website
0.

While, as FOSS activists, we’re very sad that the Judge has
chosen to use a proprietary videochat platform, we’re glad that
PSTN dial-in
is provided, and we’ll be dialing in and encourage you to do so as well.
Watch our microblog for live updates!


0 Please
take careful note of the warning on the Judge’s website: Recording,
copying, photographing and rebroadcasting of court proceedings is prohibited
by federal law.
Remember: you can take as many notes as you like, and
even live blog/microblog what you hear, but take great care to follow the
directives on Judge Staton’s website.

Federal Hearing about Rights under GPL

Post Syndicated from Bradley M. Kuhn original http://ebb.org/bkuhn/blog/2022/05/11/vizio-gpl-federal-hearing.html

[ This is
a crosspost
from my professional blog at Software Freedom Conservancy
(SFC)
. I encourage you
to use
that copy of the post as the canonical linkage for this essay — I
crossposted here merely for posterity and to reach a wider
audience. ]

Possible Opportunity for the Public To Hear Oral Arguments in Key GPL Enforcement Case

In our previous update regarding our copyleft
enforcement lawsuit against Vizio
, we talked about how Vizio
“removed” the case to USA federal court (namely, the Central
District of California), and how we filed a motion to “remand”
the case back to state court. While this all seems like minor legal
wrangling early in a case, this very first skirmish in our case goes to the
very heart of the right for software repair for consumers. While it won’t
be a final decision in the case, this motion will be the first indication
whether the federal courts view the GPL as purely a copyright license, or
as a contract, or as both. That question has been central to legal debate
about the GPL for decades, and, thanks to our case, for the first time, a
federal Court will directly consider this question.

Our view (and the view of many attorneys whose opinions we trust) and which is supported by substantial case law, is that the
GPL functions as both a copyright license and a contract, and that third
parties who receive distribution of GPL’d (and LGPL’d) software are
third-party beneficiaries. We’ve done both copyright-based and
contract-based enforcement, and both have their advantages. Contract-based enforcement as a third-party has advantages that are central to the GPL’s policy goals. Consumers are the first to discover violations in the first place. Consumers are the most likely to utilize complete, corresponding source code (CCS) to enhance their use of the products they have purchased. Third-party, contractual based enforcement gives consumers legal authority when they ask companies for access to the source code that should be available to them. In other words, this approach gives consumers the
ability to ask the Court directly for the most
important
thing that copyleft assures: a right to receive the
CCS and “the scripts used to control
compilation and installation of the executable”. Indeed, in our suit we have asked only for access to the source code, not for any money.

Our case
now is the first of its kind to adjudicate the third-party beneficiary
contractual theory. We are excited that a federal district Court is poised
to give its first answer to the central question to this endeavor, namely:
“Are the GPL and LGPL merely copyright licenses, and thus
preempted and only subject matter for the US federal courts, or can a
third-party bring a contract claim in state court?” If this
question intrigues you, we encourage you to read our motion
for remand
, Vizio’s reply to that motion
and our rebuttal reply.

Most importantly, clear your calendar for this Friday 13 May 2022 at 10:30
US/Pacific! While Judge Staton may chose to rule on this motion strictly
based on those paper filings, the judge has scheduled a hearing for
that date and time. What’s more, anyone in the world can attend this hearing to
listen! Instructions for how to
attend are
found on Judge Staton’s
website
0.

While, as FOSS activists, we’re very sad that the Judge has
chosen to use a proprietary videochat platform, we’re glad that
PSTN dial-in
is provided, and we’ll be dialing in and encourage you to do so as well.
Watch our microblog for live updates!


0 Please
take careful note of the warning on the Judge’s website: Recording,
copying, photographing and rebroadcasting of court proceedings is prohibited
by federal law.
Remember: you can take as many notes as you like, and
even live blog/microblog what you hear, but take great care to follow the
directives on Judge Staton’s website.

Federal Hearing about Rights under GPL

Post Syndicated from Bradley M. Kuhn original http://ebb.org/bkuhn/blog/2022/05/11/vizio-gpl-federal-hearing.html

[ This is
a crosspost
from my professional blog at Software Freedom Conservancy
(SFC)
. I encourage you
to use
that copy of the post as the canonical linkage for this essay — I
crossposted here merely for posterity and to reach a wider
audience. ]

Possible Opportunity for the Public To Hear Oral Arguments in Key GPL Enforcement Case

In our previous update regarding our copyleft
enforcement lawsuit against Vizio
, we talked about how Vizio
“removed” the case to USA federal court (namely, the Central
District of California), and how we filed a motion to “remand”
the case back to state court. While this all seems like minor legal
wrangling early in a case, this very first skirmish in our case goes to the
very heart of the right for software repair for consumers. While it won’t
be a final decision in the case, this motion will be the first indication
whether the federal courts view the GPL as purely a copyright license, or
as a contract, or as both. That question has been central to legal debate
about the GPL for decades, and, thanks to our case, for the first time, a
federal Court will directly consider this question.

Our view (and the view of many attorneys whose opinions we trust) and which is supported by substantial case law, is that the
GPL functions as both a copyright license and a contract, and that third
parties who receive distribution of GPL’d (and LGPL’d) software are
third-party beneficiaries. We’ve done both copyright-based and
contract-based enforcement, and both have their advantages. Contract-based enforcement as a third-party has advantages that are central to the GPL’s policy goals. Consumers are the first to discover violations in the first place. Consumers are the most likely to utilize complete, corresponding source code (CCS) to enhance their use of the products they have purchased. Third-party, contractual based enforcement gives consumers legal authority when they ask companies for access to the source code that should be available to them. In other words, this approach gives consumers the
ability to ask the Court directly for the most
important
thing that copyleft assures: a right to receive the
CCS and “the scripts used to control
compilation and installation of the executable”. Indeed, in our suit we have asked only for access to the source code, not for any money.

Our case
now is the first of its kind to adjudicate the third-party beneficiary
contractual theory. We are excited that a federal district Court is poised
to give its first answer to the central question to this endeavor, namely:
“Are the GPL and LGPL merely copyright licenses, and thus
preempted and only subject matter for the US federal courts, or can a
third-party bring a contract claim in state court?” If this
question intrigues you, we encourage you to read our motion
for remand
, Vizio’s reply to that motion
and our rebuttal reply.

Most importantly, clear your calendar for this Friday 13 May 2022 at 10:30
US/Pacific! While Judge Staton may chose to rule on this motion strictly
based on those paper filings, the judge has scheduled a hearing for
that date and time. What’s more, anyone in the world can attend this hearing to
listen! Instructions for how to
attend are
found on Judge Staton’s
website
0.

While, as FOSS activists, we’re very sad that the Judge has
chosen to use a proprietary videochat platform, we’re glad that
PSTN dial-in
is provided, and we’ll be dialing in and encourage you to do so as well.
Watch our microblog for live updates!


0 Please
take careful note of the warning on the Judge’s website: Recording,
copying, photographing and rebroadcasting of court proceedings is prohibited
by federal law.
Remember: you can take as many notes as you like, and
even live blog/microblog what you hear, but take great care to follow the
directives on Judge Staton’s website.

Federal Hearing about Rights under GPL

Post Syndicated from Bradley M. Kuhn original http://ebb.org/bkuhn/blog/2022/05/11/vizio-gpl-federal-hearing.html

[ This is
a crosspost
from my professional blog at Software Freedom Conservancy
(SFC)
. I encourage you
to use
that copy of the post as the canonical linkage for this essay — I
crossposted here merely for posterity and to reach a wider
audience. ]

Possible Opportunity for the Public To Hear Oral Arguments in Key GPL Enforcement Case

In our previous update regarding our copyleft
enforcement lawsuit against Vizio
, we talked about how Vizio
“removed” the case to USA federal court (namely, the Central
District of California), and how we filed a motion to “remand”
the case back to state court. While this all seems like minor legal
wrangling early in a case, this very first skirmish in our case goes to the
very heart of the right for software repair for consumers. While it won’t
be a final decision in the case, this motion will be the first indication
whether the federal courts view the GPL as purely a copyright license, or
as a contract, or as both. That question has been central to legal debate
about the GPL for decades, and, thanks to our case, for the first time, a
federal Court will directly consider this question.

Our view (and the view of many attorneys whose opinions we trust) and which is supported by substantial case law, is that the
GPL functions as both a copyright license and a contract, and that third
parties who receive distribution of GPL’d (and LGPL’d) software are
third-party beneficiaries. We’ve done both copyright-based and
contract-based enforcement, and both have their advantages. Contract-based enforcement as a third-party has advantages that are central to the GPL’s policy goals. Consumers are the first to discover violations in the first place. Consumers are the most likely to utilize complete, corresponding source code (CCS) to enhance their use of the products they have purchased. Third-party, contractual based enforcement gives consumers legal authority when they ask companies for access to the source code that should be available to them. In other words, this approach gives consumers the
ability to ask the Court directly for the most
important
thing that copyleft assures: a right to receive the
CCS and “the scripts used to control
compilation and installation of the executable”. Indeed, in our suit we have asked only for access to the source code, not for any money.

Our case
now is the first of its kind to adjudicate the third-party beneficiary
contractual theory. We are excited that a federal district Court is poised
to give its first answer to the central question to this endeavor, namely:
“Are the GPL and LGPL merely copyright licenses, and thus
preempted and only subject matter for the US federal courts, or can a
third-party bring a contract claim in state court?” If this
question intrigues you, we encourage you to read our motion
for remand
, Vizio’s reply to that motion
and our rebuttal reply.

Most importantly, clear your calendar for this Friday 13 May 2022 at 10:30
US/Pacific! While Judge Staton may chose to rule on this motion strictly
based on those paper filings, the judge has scheduled a hearing for
that date and time. What’s more, anyone in the world can attend this hearing to
listen! Instructions for how to
attend are
found on Judge Staton’s
website
0.

While, as FOSS activists, we’re very sad that the Judge has
chosen to use a proprietary videochat platform, we’re glad that
PSTN dial-in
is provided, and we’ll be dialing in and encourage you to do so as well.
Watch our microblog for live updates!


0 Please
take careful note of the warning on the Judge’s website: Recording,
copying, photographing and rebroadcasting of court proceedings is prohibited
by federal law.
Remember: you can take as many notes as you like, and
even live blog/microblog what you hear, but take great care to follow the
directives on Judge Staton’s website.

Federal Hearing about Rights under GPL

Post Syndicated from Bradley M. Kuhn original http://ebb.org/bkuhn/blog/2022/05/11/vizio-gpl-federal-hearing.html

[ This is
a crosspost
from my professional blog at Software Freedom Conservancy
(SFC)
. I encourage you
to use
that copy of the post as the canonical linkage for this essay — I
crossposted here merely for posterity and to reach a wider
audience. ]

Possible Opportunity for the Public To Hear Oral Arguments in Key GPL Enforcement Case

In our previous update regarding our copyleft
enforcement lawsuit against Vizio
, we talked about how Vizio
“removed” the case to USA federal court (namely, the Central
District of California), and how we filed a motion to “remand”
the case back to state court. While this all seems like minor legal
wrangling early in a case, this very first skirmish in our case goes to the
very heart of the right for software repair for consumers. While it won’t
be a final decision in the case, this motion will be the first indication
whether the federal courts view the GPL as purely a copyright license, or
as a contract, or as both. That question has been central to legal debate
about the GPL for decades, and, thanks to our case, for the first time, a
federal Court will directly consider this question.

Our view (and the view of many attorneys whose opinions we trust) and which is supported by substantial case law, is that the
GPL functions as both a copyright license and a contract, and that third
parties who receive distribution of GPL’d (and LGPL’d) software are
third-party beneficiaries. We’ve done both copyright-based and
contract-based enforcement, and both have their advantages. Contract-based enforcement as a third-party has advantages that are central to the GPL’s policy goals. Consumers are the first to discover violations in the first place. Consumers are the most likely to utilize complete, corresponding source code (CCS) to enhance their use of the products they have purchased. Third-party, contractual based enforcement gives consumers legal authority when they ask companies for access to the source code that should be available to them. In other words, this approach gives consumers the
ability to ask the Court directly for the most
important
thing that copyleft assures: a right to receive the
CCS and “the scripts used to control
compilation and installation of the executable”. Indeed, in our suit we have asked only for access to the source code, not for any money.

Our case
now is the first of its kind to adjudicate the third-party beneficiary
contractual theory. We are excited that a federal district Court is poised
to give its first answer to the central question to this endeavor, namely:
“Are the GPL and LGPL merely copyright licenses, and thus
preempted and only subject matter for the US federal courts, or can a
third-party bring a contract claim in state court?” If this
question intrigues you, we encourage you to read our motion
for remand
, Vizio’s reply to that motion
and our rebuttal reply.

Most importantly, clear your calendar for this Friday 13 May 2022 at 10:30
US/Pacific! While Judge Staton may chose to rule on this motion strictly
based on those paper filings, the judge has scheduled a hearing for
that date and time. What’s more, anyone in the world can attend this hearing to
listen! Instructions for how to
attend are
found on Judge Staton’s
website
0.

While, as FOSS activists, we’re very sad that the Judge has
chosen to use a proprietary videochat platform, we’re glad that
PSTN dial-in
is provided, and we’ll be dialing in and encourage you to do so as well.
Watch our microblog for live updates!


0 Please
take careful note of the warning on the Judge’s website: Recording,
copying, photographing and rebroadcasting of court proceedings is prohibited
by federal law.
Remember: you can take as many notes as you like, and
even live blog/microblog what you hear, but take great care to follow the
directives on Judge Staton’s website.

Federal Hearing about Rights under GPL

Post Syndicated from Bradley M. Kuhn original http://ebb.org/bkuhn/blog/2022/05/11/vizio-gpl-federal-hearing.html

[ This is
a crosspost
from my professional blog at Software Freedom Conservancy
(SFC)
. I encourage you
to use
that copy of the post as the canonical linkage for this essay — I
crossposted here merely for posterity and to reach a wider
audience. ]

Possible Opportunity for the Public To Hear Oral Arguments in Key GPL Enforcement Case

In our previous update regarding our copyleft
enforcement lawsuit against Vizio
, we talked about how Vizio
“removed” the case to USA federal court (namely, the Central
District of California), and how we filed a motion to “remand”
the case back to state court. While this all seems like minor legal
wrangling early in a case, this very first skirmish in our case goes to the
very heart of the right for software repair for consumers. While it won’t
be a final decision in the case, this motion will be the first indication
whether the federal courts view the GPL as purely a copyright license, or
as a contract, or as both. That question has been central to legal debate
about the GPL for decades, and, thanks to our case, for the first time, a
federal Court will directly consider this question.

Our view (and the view of many attorneys whose opinions we trust) and which is supported by substantial case law, is that the
GPL functions as both a copyright license and a contract, and that third
parties who receive distribution of GPL’d (and LGPL’d) software are
third-party beneficiaries. We’ve done both copyright-based and
contract-based enforcement, and both have their advantages. Contract-based enforcement as a third-party has advantages that are central to the GPL’s policy goals. Consumers are the first to discover violations in the first place. Consumers are the most likely to utilize complete, corresponding source code (CCS) to enhance their use of the products they have purchased. Third-party, contractual based enforcement gives consumers legal authority when they ask companies for access to the source code that should be available to them. In other words, this approach gives consumers the
ability to ask the Court directly for the most
important
thing that copyleft assures: a right to receive the
CCS and “the scripts used to control
compilation and installation of the executable”. Indeed, in our suit we have asked only for access to the source code, not for any money.

Our case
now is the first of its kind to adjudicate the third-party beneficiary
contractual theory. We are excited that a federal district Court is poised
to give its first answer to the central question to this endeavor, namely:
“Are the GPL and LGPL merely copyright licenses, and thus
preempted and only subject matter for the US federal courts, or can a
third-party bring a contract claim in state court?” If this
question intrigues you, we encourage you to read our motion
for remand
, Vizio’s reply to that motion
and our rebuttal reply.

Most importantly, clear your calendar for this Friday 13 May 2022 at 10:30
US/Pacific! While Judge Staton may chose to rule on this motion strictly
based on those paper filings, the judge has scheduled a hearing for
that date and time. What’s more, anyone in the world can attend this hearing to
listen! Instructions for how to
attend are
found on Judge Staton’s
website
0.

While, as FOSS activists, we’re very sad that the Judge has
chosen to use a proprietary videochat platform, we’re glad that
PSTN dial-in
is provided, and we’ll be dialing in and encourage you to do so as well.
Watch our microblog for live updates!


0 Please
take careful note of the warning on the Judge’s website: Recording,
copying, photographing and rebroadcasting of court proceedings is prohibited
by federal law.
Remember: you can take as many notes as you like, and
even live blog/microblog what you hear, but take great care to follow the
directives on Judge Staton’s website.

Federal Hearing about Rights under GPL

Post Syndicated from Bradley M. Kuhn original http://ebb.org/bkuhn/blog/2022/05/11/vizio-gpl-federal-hearing.html

[ This is
a crosspost
from my professional blog at Software Freedom Conservancy
(SFC)
. I encourage you
to use
that copy of the post as the canonical linkage for this essay — I
crossposted here merely for posterity and to reach a wider
audience. ]

Possible Opportunity for the Public To Hear Oral Arguments in Key GPL Enforcement Case

In our previous update regarding our copyleft
enforcement lawsuit against Vizio
, we talked about how Vizio
“removed” the case to USA federal court (namely, the Central
District of California), and how we filed a motion to “remand”
the case back to state court. While this all seems like minor legal
wrangling early in a case, this very first skirmish in our case goes to the
very heart of the right for software repair for consumers. While it won’t
be a final decision in the case, this motion will be the first indication
whether the federal courts view the GPL as purely a copyright license, or
as a contract, or as both. That question has been central to legal debate
about the GPL for decades, and, thanks to our case, for the first time, a
federal Court will directly consider this question.

Our view (and the view of many attorneys whose opinions we trust) and which is supported by substantial case law, is that the
GPL functions as both a copyright license and a contract, and that third
parties who receive distribution of GPL’d (and LGPL’d) software are
third-party beneficiaries. We’ve done both copyright-based and
contract-based enforcement, and both have their advantages. Contract-based enforcement as a third-party has advantages that are central to the GPL’s policy goals. Consumers are the first to discover violations in the first place. Consumers are the most likely to utilize complete, corresponding source code (CCS) to enhance their use of the products they have purchased. Third-party, contractual based enforcement gives consumers legal authority when they ask companies for access to the source code that should be available to them. In other words, this approach gives consumers the
ability to ask the Court directly for the most
important
thing that copyleft assures: a right to receive the
CCS and “the scripts used to control
compilation and installation of the executable”. Indeed, in our suit we have asked only for access to the source code, not for any money.

Our case
now is the first of its kind to adjudicate the third-party beneficiary
contractual theory. We are excited that a federal district Court is poised
to give its first answer to the central question to this endeavor, namely:
“Are the GPL and LGPL merely copyright licenses, and thus
preempted and only subject matter for the US federal courts, or can a
third-party bring a contract claim in state court?” If this
question intrigues you, we encourage you to read our motion
for remand
, Vizio’s reply to that motion
and our rebuttal reply.

Most importantly, clear your calendar for this Friday 13 May 2022 at 10:30
US/Pacific! While Judge Staton may chose to rule on this motion strictly
based on those paper filings, the judge has scheduled a hearing for
that date and time. What’s more, anyone in the world can attend this hearing to
listen! Instructions for how to
attend are
found on Judge Staton’s
website
0.

While, as FOSS activists, we’re very sad that the Judge has
chosen to use a proprietary videochat platform, we’re glad that
PSTN dial-in
is provided, and we’ll be dialing in and encourage you to do so as well.
Watch our microblog for live updates!


0 Please
take careful note of the warning on the Judge’s website: Recording,
copying, photographing and rebroadcasting of court proceedings is prohibited
by federal law.
Remember: you can take as many notes as you like, and
even live blog/microblog what you hear, but take great care to follow the
directives on Judge Staton’s website.

Federal Hearing about Rights under GPL

Post Syndicated from Bradley M. Kuhn original http://ebb.org/bkuhn/blog/2022/05/11/vizio-gpl-federal-hearing.html

[ This is
a crosspost
from my professional blog at Software Freedom Conservancy
(SFC)
. I encourage you
to use
that copy of the post as the canonical linkage for this essay — I
crossposted here merely for posterity and to reach a wider
audience. ]

Possible Opportunity for the Public To Hear Oral Arguments in Key GPL Enforcement Case

In our previous update regarding our copyleft
enforcement lawsuit against Vizio
, we talked about how Vizio
“removed” the case to USA federal court (namely, the Central
District of California), and how we filed a motion to “remand”
the case back to state court. While this all seems like minor legal
wrangling early in a case, this very first skirmish in our case goes to the
very heart of the right for software repair for consumers. While it won’t
be a final decision in the case, this motion will be the first indication
whether the federal courts view the GPL as purely a copyright license, or
as a contract, or as both. That question has been central to legal debate
about the GPL for decades, and, thanks to our case, for the first time, a
federal Court will directly consider this question.

Our view (and the view of many attorneys whose opinions we trust) and which is supported by substantial case law, is that the
GPL functions as both a copyright license and a contract, and that third
parties who receive distribution of GPL’d (and LGPL’d) software are
third-party beneficiaries. We’ve done both copyright-based and
contract-based enforcement, and both have their advantages. Contract-based enforcement as a third-party has advantages that are central to the GPL’s policy goals. Consumers are the first to discover violations in the first place. Consumers are the most likely to utilize complete, corresponding source code (CCS) to enhance their use of the products they have purchased. Third-party, contractual based enforcement gives consumers legal authority when they ask companies for access to the source code that should be available to them. In other words, this approach gives consumers the
ability to ask the Court directly for the most
important
thing that copyleft assures: a right to receive the
CCS and “the scripts used to control
compilation and installation of the executable”. Indeed, in our suit we have asked only for access to the source code, not for any money.

Our case
now is the first of its kind to adjudicate the third-party beneficiary
contractual theory. We are excited that a federal district Court is poised
to give its first answer to the central question to this endeavor, namely:
“Are the GPL and LGPL merely copyright licenses, and thus
preempted and only subject matter for the US federal courts, or can a
third-party bring a contract claim in state court?” If this
question intrigues you, we encourage you to read our motion
for remand
, Vizio’s reply to that motion
and our rebuttal reply.

Most importantly, clear your calendar for this Friday 13 May 2022 at 10:30
US/Pacific! While Judge Staton may chose to rule on this motion strictly
based on those paper filings, the judge has scheduled a hearing for
that date and time. What’s more, anyone in the world can attend this hearing to
listen! Instructions for how to
attend are
found on Judge Staton’s
website
0.

While, as FOSS activists, we’re very sad that the Judge has
chosen to use a proprietary videochat platform, we’re glad that
PSTN dial-in
is provided, and we’ll be dialing in and encourage you to do so as well.
Watch our microblog for live updates!


0 Please
take careful note of the warning on the Judge’s website: Recording,
copying, photographing and rebroadcasting of court proceedings is prohibited
by federal law.
Remember: you can take as many notes as you like, and
even live blog/microblog what you hear, but take great care to follow the
directives on Judge Staton’s website.

Federal Hearing about Rights under GPL

Post Syndicated from Bradley M. Kuhn original http://ebb.org/bkuhn/blog/2022/05/11/vizio-gpl-federal-hearing.html

[ This is
a crosspost
from my professional blog at Software Freedom Conservancy
(SFC)
. I encourage you
to use
that copy of the post as the canonical linkage for this essay — I
crossposted here merely for posterity and to reach a wider
audience. ]

Possible Opportunity for the Public To Hear Oral Arguments in Key GPL Enforcement Case

In our previous update regarding our copyleft
enforcement lawsuit against Vizio
, we talked about how Vizio
“removed” the case to USA federal court (namely, the Central
District of California), and how we filed a motion to “remand”
the case back to state court. While this all seems like minor legal
wrangling early in a case, this very first skirmish in our case goes to the
very heart of the right for software repair for consumers. While it won’t
be a final decision in the case, this motion will be the first indication
whether the federal courts view the GPL as purely a copyright license, or
as a contract, or as both. That question has been central to legal debate
about the GPL for decades, and, thanks to our case, for the first time, a
federal Court will directly consider this question.

Our view (and the view of many attorneys whose opinions we trust) and which is supported by substantial case law, is that the
GPL functions as both a copyright license and a contract, and that third
parties who receive distribution of GPL’d (and LGPL’d) software are
third-party beneficiaries. We’ve done both copyright-based and
contract-based enforcement, and both have their advantages. Contract-based enforcement as a third-party has advantages that are central to the GPL’s policy goals. Consumers are the first to discover violations in the first place. Consumers are the most likely to utilize complete, corresponding source code (CCS) to enhance their use of the products they have purchased. Third-party, contractual based enforcement gives consumers legal authority when they ask companies for access to the source code that should be available to them. In other words, this approach gives consumers the
ability to ask the Court directly for the most
important
thing that copyleft assures: a right to receive the
CCS and “the scripts used to control
compilation and installation of the executable”. Indeed, in our suit we have asked only for access to the source code, not for any money.

Our case
now is the first of its kind to adjudicate the third-party beneficiary
contractual theory. We are excited that a federal district Court is poised
to give its first answer to the central question to this endeavor, namely:
“Are the GPL and LGPL merely copyright licenses, and thus
preempted and only subject matter for the US federal courts, or can a
third-party bring a contract claim in state court?” If this
question intrigues you, we encourage you to read our motion
for remand
, Vizio’s reply to that motion
and our rebuttal reply.

Most importantly, clear your calendar for this Friday 13 May 2022 at 10:30
US/Pacific! While Judge Staton may chose to rule on this motion strictly
based on those paper filings, the judge has scheduled a hearing for
that date and time. What’s more, anyone in the world can attend this hearing to
listen! Instructions for how to
attend are
found on Judge Staton’s
website
0.

While, as FOSS activists, we’re very sad that the Judge has
chosen to use a proprietary videochat platform, we’re glad that
PSTN dial-in
is provided, and we’ll be dialing in and encourage you to do so as well.
Watch our microblog for live updates!


0 Please
take careful note of the warning on the Judge’s website: Recording,
copying, photographing and rebroadcasting of court proceedings is prohibited
by federal law.
Remember: you can take as many notes as you like, and
even live blog/microblog what you hear, but take great care to follow the
directives on Judge Staton’s website.

Federal Hearing about Rights under GPL

Post Syndicated from Bradley M. Kuhn original http://ebb.org/bkuhn/blog/2022/05/11/vizio-gpl-federal-hearing.html

[ This is
a crosspost
from my professional blog at Software Freedom Conservancy
(SFC)
. I encourage you
to use
that copy of the post as the canonical linkage for this essay — I
crossposted here merely for posterity and to reach a wider
audience. ]

Possible Opportunity for the Public To Hear Oral Arguments in Key GPL Enforcement Case

In our previous update regarding our copyleft
enforcement lawsuit against Vizio
, we talked about how Vizio
“removed” the case to USA federal court (namely, the Central
District of California), and how we filed a motion to “remand”
the case back to state court. While this all seems like minor legal
wrangling early in a case, this very first skirmish in our case goes to the
very heart of the right for software repair for consumers. While it won’t
be a final decision in the case, this motion will be the first indication
whether the federal courts view the GPL as purely a copyright license, or
as a contract, or as both. That question has been central to legal debate
about the GPL for decades, and, thanks to our case, for the first time, a
federal Court will directly consider this question.

Our view (and the view of many attorneys whose opinions we trust) and which is supported by substantial case law, is that the
GPL functions as both a copyright license and a contract, and that third
parties who receive distribution of GPL’d (and LGPL’d) software are
third-party beneficiaries. We’ve done both copyright-based and
contract-based enforcement, and both have their advantages. Contract-based enforcement as a third-party has advantages that are central to the GPL’s policy goals. Consumers are the first to discover violations in the first place. Consumers are the most likely to utilize complete, corresponding source code (CCS) to enhance their use of the products they have purchased. Third-party, contractual based enforcement gives consumers legal authority when they ask companies for access to the source code that should be available to them. In other words, this approach gives consumers the
ability to ask the Court directly for the most
important
thing that copyleft assures: a right to receive the
CCS and “the scripts used to control
compilation and installation of the executable”. Indeed, in our suit we have asked only for access to the source code, not for any money.

Our case
now is the first of its kind to adjudicate the third-party beneficiary
contractual theory. We are excited that a federal district Court is poised
to give its first answer to the central question to this endeavor, namely:
“Are the GPL and LGPL merely copyright licenses, and thus
preempted and only subject matter for the US federal courts, or can a
third-party bring a contract claim in state court?” If this
question intrigues you, we encourage you to read our motion
for remand
, Vizio’s reply to that motion
and our rebuttal reply.

Most importantly, clear your calendar for this Friday 13 May 2022 at 10:30
US/Pacific! While Judge Staton may chose to rule on this motion strictly
based on those paper filings, the judge has scheduled a hearing for
that date and time. What’s more, anyone in the world can attend this hearing to
listen! Instructions for how to
attend are
found on Judge Staton’s
website
0.

While, as FOSS activists, we’re very sad that the Judge has
chosen to use a proprietary videochat platform, we’re glad that
PSTN dial-in
is provided, and we’ll be dialing in and encourage you to do so as well.
Watch our microblog for live updates!


0 Please
take careful note of the warning on the Judge’s website: Recording,
copying, photographing and rebroadcasting of court proceedings is prohibited
by federal law.
Remember: you can take as many notes as you like, and
even live blog/microblog what you hear, but take great care to follow the
directives on Judge Staton’s website.

Federal Hearing about Rights under GPL

Post Syndicated from Bradley M. Kuhn original http://ebb.org/bkuhn/blog/2022/05/11/vizio-gpl-federal-hearing.html

[ This is
a crosspost
from my professional blog at Software Freedom Conservancy
(SFC)
. I encourage you
to use
that copy of the post as the canonical linkage for this essay — I
crossposted here merely for posterity and to reach a wider
audience. ]

Possible Opportunity for the Public To Hear Oral Arguments in Key GPL Enforcement Case

In our previous update regarding our copyleft
enforcement lawsuit against Vizio
, we talked about how Vizio
“removed” the case to USA federal court (namely, the Central
District of California), and how we filed a motion to “remand”
the case back to state court. While this all seems like minor legal
wrangling early in a case, this very first skirmish in our case goes to the
very heart of the right for software repair for consumers. While it won’t
be a final decision in the case, this motion will be the first indication
whether the federal courts view the GPL as purely a copyright license, or
as a contract, or as both. That question has been central to legal debate
about the GPL for decades, and, thanks to our case, for the first time, a
federal Court will directly consider this question.

Our view (and the view of many attorneys whose opinions we trust) and which is supported by substantial case law, is that the
GPL functions as both a copyright license and a contract, and that third
parties who receive distribution of GPL’d (and LGPL’d) software are
third-party beneficiaries. We’ve done both copyright-based and
contract-based enforcement, and both have their advantages. Contract-based enforcement as a third-party has advantages that are central to the GPL’s policy goals. Consumers are the first to discover violations in the first place. Consumers are the most likely to utilize complete, corresponding source code (CCS) to enhance their use of the products they have purchased. Third-party, contractual based enforcement gives consumers legal authority when they ask companies for access to the source code that should be available to them. In other words, this approach gives consumers the
ability to ask the Court directly for the most
important
thing that copyleft assures: a right to receive the
CCS and “the scripts used to control
compilation and installation of the executable”. Indeed, in our suit we have asked only for access to the source code, not for any money.

Our case
now is the first of its kind to adjudicate the third-party beneficiary
contractual theory. We are excited that a federal district Court is poised
to give its first answer to the central question to this endeavor, namely:
“Are the GPL and LGPL merely copyright licenses, and thus
preempted and only subject matter for the US federal courts, or can a
third-party bring a contract claim in state court?” If this
question intrigues you, we encourage you to read our motion
for remand
, Vizio’s reply to that motion
and our rebuttal reply.

Most importantly, clear your calendar for this Friday 13 May 2022 at 10:30
US/Pacific! While Judge Staton may chose to rule on this motion strictly
based on those paper filings, the judge has scheduled a hearing for
that date and time. What’s more, anyone in the world can attend this hearing to
listen! Instructions for how to
attend are
found on Judge Staton’s
website
0.

While, as FOSS activists, we’re very sad that the Judge has
chosen to use a proprietary videochat platform, we’re glad that
PSTN dial-in
is provided, and we’ll be dialing in and encourage you to do so as well.
Watch our microblog for live updates!


0 Please
take careful note of the warning on the Judge’s website: Recording,
copying, photographing and rebroadcasting of court proceedings is prohibited
by federal law.
Remember: you can take as many notes as you like, and
even live blog/microblog what you hear, but take great care to follow the
directives on Judge Staton’s website.

Federal Hearing about Rights under GPL

Post Syndicated from Bradley M. Kuhn original http://ebb.org/bkuhn/blog/2022/05/11/vizio-gpl-federal-hearing.html

[ This is
a crosspost
from my professional blog at Software Freedom Conservancy
(SFC)
. I encourage you
to use
that copy of the post as the canonical linkage for this essay — I
crossposted here merely for posterity and to reach a wider
audience. ]

Possible Opportunity for the Public To Hear Oral Arguments in Key GPL Enforcement Case

In our previous update regarding our copyleft
enforcement lawsuit against Vizio
, we talked about how Vizio
“removed” the case to USA federal court (namely, the Central
District of California), and how we filed a motion to “remand”
the case back to state court. While this all seems like minor legal
wrangling early in a case, this very first skirmish in our case goes to the
very heart of the right for software repair for consumers. While it won’t
be a final decision in the case, this motion will be the first indication
whether the federal courts view the GPL as purely a copyright license, or
as a contract, or as both. That question has been central to legal debate
about the GPL for decades, and, thanks to our case, for the first time, a
federal Court will directly consider this question.

Our view (and the view of many attorneys whose opinions we trust) and which is supported by substantial case law, is that the
GPL functions as both a copyright license and a contract, and that third
parties who receive distribution of GPL’d (and LGPL’d) software are
third-party beneficiaries. We’ve done both copyright-based and
contract-based enforcement, and both have their advantages. Contract-based enforcement as a third-party has advantages that are central to the GPL’s policy goals. Consumers are the first to discover violations in the first place. Consumers are the most likely to utilize complete, corresponding source code (CCS) to enhance their use of the products they have purchased. Third-party, contractual based enforcement gives consumers legal authority when they ask companies for access to the source code that should be available to them. In other words, this approach gives consumers the
ability to ask the Court directly for the most
important
thing that copyleft assures: a right to receive the
CCS and “the scripts used to control
compilation and installation of the executable”. Indeed, in our suit we have asked only for access to the source code, not for any money.

Our case
now is the first of its kind to adjudicate the third-party beneficiary
contractual theory. We are excited that a federal district Court is poised
to give its first answer to the central question to this endeavor, namely:
“Are the GPL and LGPL merely copyright licenses, and thus
preempted and only subject matter for the US federal courts, or can a
third-party bring a contract claim in state court?” If this
question intrigues you, we encourage you to read our motion
for remand
, Vizio’s reply to that motion
and our rebuttal reply.

Most importantly, clear your calendar for this Friday 13 May 2022 at 10:30
US/Pacific! While Judge Staton may chose to rule on this motion strictly
based on those paper filings, the judge has scheduled a hearing for
that date and time. What’s more, anyone in the world can attend this hearing to
listen! Instructions for how to
attend are
found on Judge Staton’s
website
0.

While, as FOSS activists, we’re very sad that the Judge has
chosen to use a proprietary videochat platform, we’re glad that
PSTN dial-in
is provided, and we’ll be dialing in and encourage you to do so as well.
Watch our microblog for live updates!


0 Please
take careful note of the warning on the Judge’s website: Recording,
copying, photographing and rebroadcasting of court proceedings is prohibited
by federal law.
Remember: you can take as many notes as you like, and
even live blog/microblog what you hear, but take great care to follow the
directives on Judge Staton’s website.

The collective thoughts of the interwebz

Proudly powered by Ants