Re: [Fwd: another try/action to fix the debian security desaster]

Ben Bucksch wrote:
> I want to sell Debian CDs (which is encouraged by Debian, without 
> special agreement). I can either take the official CD images, unchanged; 
> in that case, I may use the name "Official Debian". Or I can create my 
> own CD set (maybe just 2 CDs, to be cheaper), then I can't call it 
> "Official Debian" anymore, but can still call it "Debian". 

Debian manage their trademark differently, because they have a different 
set of requirements and issues. Who would try and distributed a trojaned 
GNU/Linux OS?

> However, you *can* say /"Everybody is allowed to call his Debian 
> derivate 'Debian', if he is are not misrepresenting or concealing the 
> nature of the content and not doing things that harm users or the Debian 
> project."/

Except that this is so vague that it basically equates to a blanket 
permission. If we go to some guy and say "you are doing things that harm 
users", he can say "No, I'm not", and because "harming users" is not 
defined, you are at a stalemate.

> That's basically what I did for Beonex. That's more or less Debian's 
> policy, as far as I know (I didn't find the new one either). 

Debian's policy is a battleground; I'm not sure what the current 
position is.

> That's what 
> I propose for mozilla.org. That would allow me to fix security bugs in 
> Firefox, even turn up the default security prefs, without confusing 
> users with a name like "Ben's Watercat", 

Except that we might not want you to turn up the default security prefs, 
because it might make the user's life a lot more inconvenient for only a 
small increase in security.

> (I argued that before with Gerv, that's why I am a bit disturbed to hear 
> the same argument unchanged again.)

Because I didn't buy it last time either :-)

> If you demand derivates to change the name, 

We are not demanding it. We are just not giving blanket permission to 
anyone to make derivatives without changing the name.

Gerv