Re: fontfile.diff applicable license, and general security issues

> >Could somebody please clarify the license that applies to:
> >
> >ftp://ftp.xfree86.org/pub/XFree86/4.3.0/fixes/fontfile.diff
> >
> >(It is noted on the XFree86.org site that the 1.1 license applies to
> >all versions of the software including and after 4.3.99.903, and that
> >the 1.0 license applies to 4.3.99.902, and prior XFree86 versions.
> >Since this patch has a timestamp which is inbetween these versions, it
> >is not clear which license applies to it.

> Quoting from http://www.xfree86.org/legal/licenses.html :
>
>   XFree86 as a whole contains software covered by a range of
>   different licenses and not a single license. This licence change
>   applies only to those portions of the code that are copyrighted
>   by The XFree86 Project, Inc. itself. Even so, some portions of
>   this code continue to carry the 1.0 license. Refer to each source
>   file for specific licence details.
>
> So, check the actual files in whatever branches of the CVS repository you
> are interested in for details if you have concerns.

xc/programs/Xsever/hw/xfree86/doc/LICENSE in the 4.3.0 release states
the license that code without an explicit copyright is licensed
under.  From the notice at:

http://xfree86.org/legal/licenses.html

I assumed that the 1.1 license would be used for all such code after
it's introcution, however checking the latest
xc/programs/Xsever/hw/xfree86/doc/LICENSE, this is not true.  Infact
the notice at the above URL is slightly misleading, in my opinion.

The patch itself does not carry a copyright notice, so I wrongly
assumed that it itself may be subject to the 1.1 license, because of
the explicit note covering code without an explicit copyright.

Note - I'm fully aware that the licenses of the original files to be
patched are applicable to the result of applying the patch to the
original files.  I am, however, _very_ skeptical about the reasoning
behind the introduction of the 1.1 license, especially as security
vulnerabilities were announced around the same time, meaning that
there is little choice but to accept it, or write your own patch.  I
consider this to be extremely irresponsible behavior for a project
which is so widely used by the free software community.  However, it
is your software, to do with what you like.

John.