Free lunch? Hal, have you somehow forgotten what makes up Free Software distributions? I'll answer that for you: the work of Free Software developers worldwide.

Many companies finance important Free Software projects and developers within their organization (Red Hat, Mandrake, etc). But how in the world did you forget that most of those businesses would not and could not exist without the vast majority of Free Software they package and distribute from the "outside" world? Indeed, these companies distribute "no cost" basic copies of their distributions as part of, among other things, the symbiotic relationship with Free Software developers worldwide. But that's not their only obligation, morally or legally. That the companies make a valid and hopefully thriving business out of Free Software is wonderful and more than encouraged, but that doesn't free them from responsibilities to the community that enables their bottom line in the first place. Part of that responsibility is providing "no cost" security fixes for their distributions, even if they didn't internally write the software that needs patching. Is this a legal requirement? Depends on the individual case. Is this a moral obligation? Absolutely.

One of your quotes quite specifically sums up the bizarre view you hold of Free Software companies:

"If you're a software vendor, these resources aren't free. Developer time that could be dedicated to creating new or improved products that are, ironically, often also given away for free, are instead devoted to providing maintenance on applications not originally authored by the vendor."

Who's creating the vast majority of the "new or improved" products they sell? Its not just those companies as you so wrongly imply, it?s the worldwide Free Software community. "Ironically, (their products are) often also given away for free". What is so ironic to you? That obligation is part of the licence requirement they practice business under, let alone a moral obligation. The above very firmly defines where your misguided perceptions and understanding of Free Software lie in my opinion.

So, in answer to your article's major query of when will Linux vendors charge for security fixes. Not ever if those companies know what's good for them and want to avoid the ire of the Free Software community that enables them to do business in the first place.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/200/23908#23908