Everything

php

Home » Project » Newsgroups » php.internals » Is this what Stefan Esser was referring to ...? »

Is this what Stefan Esser was referring to ...?

php.internals

Jochem Maas

19 years ago

whilst reading the thread on security issues in response to
the article on the theregister.co.uk I came accross a remark
by Stefan Esser aimed at Chris Shiftlett which I didn't
understand, is this what he was referring to when he pointed
a/the violation of the php license?:

http://phpsec.org/images/phpsecinfo_ss.png

1. I don't feel strongly about the problem.
2. I don't want to stir any animosity towards phpsec or Chris Shiftlett
(Im very grateful for all the things I have learnt form them/him)
3. Stefan Essers apparent feeling of ill treatment may be colouring his
manner in terms of communicating this (and other) issue(s)

BUT ... doesn't Stefan have a valid point with regards to the
violation?

if not I guess my understanding of the PHP licence and the
PHP Group's policy is incorrect (I will make a go of rereading to correct
that mistake) but I would have thought that someone would have, very quickly,
offered up the reason(s) as to why there was no violation.

if yes then I'm rather surprised that:

a. the point was glossed over in favour of tackling Stefan's manner.
b. Chris Shiflett (and/or phpsec) didn't spot the 'problem' and
correct it proactively (I'm guessing, given his standing within the php
community, Chris know where his towel is, so to speak)
c. an amicable, behind the scenes solution was not crafted and implemented
(I gather Chris is good friends with more than one of the members/founders
of the PHP group) - in the spirit of portraying a consistent image/message
to the outside world - at the end of the day changing a logo and colour
scheme for the output of the tool in question is a rather minor technical
challenge (it seems to me).

I ask purely out of an insatiable curiosity with regard to anything that
has to do with php, I'd be very for any comments anyone offer
on this issue.

It has not been my intention to offend anyone so I apologize in advance
if I have inadvertently done so.

kind regards,
Jochem

Stefan Esser

19 years ago

> http://phpsec.org/images/phpsecinfo_ss.png
>

Yes it is exactly what I am talking about

1) CSS code is directly stolen from PHP source code (PHP licensed code)
2) Output functions are directly converted from C to PHP code
3) The PHP logo is used although it is clearly in violation with
http://www.php.net/download-logos.php / Logo Licensing
... If in doubt, ask <mailto:logos@php.net>. However you should not use
the logo in such a way, that it suggests that a particular person,
company, course, etc. is endorsed by PHP.net.

Stefan Esser

Marcus Börger

19 years ago

Hello Jochem,

actually this should be discussed with group@php.net and only with group at
php dot net.

best regards
marcus

Saturday, January 20, 2007, 11:56:46 PM, you wrote:

> whilst reading the thread on security issues in response to
> the article on the theregister.co.uk I came accross a remark
> by Stefan Esser aimed at Chris Shiftlett which I didn't
> understand, is this what he was referring to when he pointed
> a/the violation of the php license?:

> http://phpsec.org/images/phpsecinfo_ss.png

> 1. I don't feel strongly about the problem.
> 2. I don't want to stir any animosity towards phpsec or Chris Shiftlett
> (Im very grateful for all the things I have learnt form them/him)
> 3. Stefan Essers apparent feeling of ill treatment may be colouring his
> manner in terms of communicating this (and other) issue(s)

> BUT ... doesn't Stefan have a valid point with regards to the
> violation?

> if not I guess my understanding of the PHP licence and the
> PHP Group's policy is incorrect (I will make a go of rereading to correct
> that mistake) but I would have thought that someone would have, very quickly,
> offered up the reason(s) as to why there was no violation.

> if yes then I'm rather surprised that:

> a. the point was glossed over in favour of tackling Stefan's manner.
> b. Chris Shiflett (and/or phpsec) didn't spot the 'problem' and
> correct it proactively (I'm guessing, given his standing within the php
> community, Chris know where his towel is, so to speak)
> c. an amicable, behind the scenes solution was not crafted and implemented
> (I gather Chris is good friends with more than one of the members/founders
> of the PHP group) - in the spirit of portraying a consistent image/message
> to the outside world - at the end of the day changing a logo and colour
> scheme for the output of the tool in question is a rather minor technical
> challenge (it seems to me).

> I ask purely out of an insatiable curiosity with regard to anything that
> has to do with php, I'd be very for any comments anyone offer
> on this issue.

> It has not been my intention to offend anyone so I apologize in advance
> if I have inadvertently done so.

> kind regards,
> Jochem

Best regards,
Marcus

Olivier Hill

19 years ago

On 1/20/07, Marcus Boerger <helly@php.net> wrote:

> Hello Jochem,
>
>  actually this should be discussed with group@php.net and only with group at
> php dot net.

[DISCLAIMER: I'm not taking side]

This is far from being transparent to the eyes of the Open Source
Community. Personnaly, I don't want to debate on this, but I surely
want to be informed about it.

Ahh politics..

Regards,
Olivier

Paul Reinheimer

19 years ago

I think it's rather extreme to be directing any animosity towards
Chris Shiflett on this particular issue, since while he leads that
group, he isn't the lead for that project. I would also not that to
the best of my knowledge (being on that team) that no one has
attempted to bring it up with the people working on the tool.

I'll bring it up on that mailing list.


paul

--
Paul Reinheimer

Rasmus Lerdorf

19 years ago

Paul Reinheimer wrote:

> I think it's rather extreme to be directing any animosity towards
> Chris Shiflett on this particular issue, since while he leads that
> group, he isn't the lead for that project. I would also not that to
> the best of my knowledge (being on that team) that no one has
> attempted to bring it up with the people working on the tool.
>
> I'll bring it up on that mailing list.

It's a bit of an edge case.  I don't think I ever really considered CSS
as being part of the PHP source code, but I suppose technically it is.

From a bigger perspective, the reason we prefer people to not use the
PHP name for their projects, especially modified versions of PHP itself,
is that in the extreme case we want to avoid someone releasing PHP 7 on
us.  That would confuse a lot of people.  For better or worse, if
someone is using PHP they are using code we have control over, so when
they report a bug or describe a problem we have a pretty good idea about
how to go about fixing it.  If they are using a heavily modified version
of PHP, then it becomes much harder for us to figure out what is going
on and by asking people to come up with their own brand for such
modifications it becomes obvious to everyone involved that there is a
different codebase involved.

-Rasmus

Alain Williams

19 years ago

On Mon, Jan 22, 2007 at 10:08:16AM +1100, Rasmus Lerdorf wrote:

> From a bigger perspective, the reason we prefer people to not use the
> PHP name for their projects, especially modified versions of PHP itself,
> is that in the extreme case we want to avoid someone releasing PHP 7 on
> us.  That would confuse a lot of people.  For better or worse, if
> someone is using PHP they are using code we have control over, so when
> they report a bug or describe a problem we have a pretty good idea about
> how to go about fixing it.  If they are using a heavily modified version
> of PHP, then it becomes much harder for us to figure out what is going
> on and by asking people to come up with their own brand for such
> modifications it becomes obvious to everyone involved that there is a
> different codebase involved.

It is a difficult problem and we need to take care before adopting a stance
on it, look what happened with the Debian firefox/iceweasle debacle.

> -Rasmus

--
Alain Williams
Linux Consultant - Mail systems, Web sites, Networking, Programmer, IT Lecturer.
+44 (0) 787 668 0256  http://www.phcomp.co.uk/
Parliament Hill Computers Ltd. Registration Information: http://www.phcomp.co.uk/contact.php
#include <std_disclaimer.h>

Ilia A.

19 years ago

On 21-Jan-07, at 6:12 PM, Alain Williams wrote:

> On Mon, Jan 22, 2007 at 10:08:16AM +1100, Rasmus Lerdorf wrote:
>
>> From a bigger perspective, the reason we prefer people to not use the
>> PHP name for their projects, especially modified versions of PHP
>> itself,
>> is that in the extreme case we want to avoid someone releasing PHP
>> 7 on
>> us.  That would confuse a lot of people.  For better or worse, if
>> someone is using PHP they are using code we have control over, so
>> when
>> they report a bug or describe a problem we have a pretty good idea
>> about
>> how to go about fixing it.  If they are using a heavily modified
>> version
>> of PHP, then it becomes much harder for us to figure out what is
>> going
>> on and by asking people to come up with their own brand for such
>> modifications it becomes obvious to everyone involved that there is a
>> different codebase involved.
>
> It is a difficult problem and we need to take care before adopting
> a stance
> on it, look what happened with the Debian firefox/iceweasle debacle.

That's a decision for PHP Group to make. Personally I think PHP
related projects should avoid using "PHP" in their name period as it
causes far too many problems for the language itself, since most
people fail to distinguish between PHP the language and project
trying to gain popularity by shoving "PHP" into its name.

Ilia Alshanetsky

Roman Neuhauser

19 years ago

# ilia@prohost.org / 2007-01-21 18:25:24 -0500:

> Personally I think PHP  related projects should avoid using "PHP" in
> their name period as it  causes far too many problems for the language
> itself, since most  people fail to distinguish between PHP the
> language and project  trying to gain popularity by shoving "PHP" into
> its name.

php.net distributes programs that violate the PHP license: e. g. PHPUnit
or PHPDocumentor (see http://pecl.php.net).  If php.net is ok with
ignoring the license terms (and has been for several years), does the
license still mean sh!t?

--
How many Vietnam vets does it take to screw in a light bulb?
You don't know, man.  You don't KNOW.
Cause you weren't THERE.             http://bash.org/?255991

Johannes Schlueter

19 years ago

On Tue, 2007-01-23 at 13:51 +0000, Roman Neuhauser wrote:

> php.net distributes programs that violate the PHP license: e. g. PHPUnit
> or PHPDocumentor (see http://pecl.php.net).  If php.net is ok with
> ignoring the license terms (and has been for several years), does the
> license still mean sh!t?

That's wrong. These two projects don't use code which is licensed under
the PHP License so the PHP Licenses doesn't affect them. (See also other
(Rasmus's?) posts in this thread. But php.net is delivering another
project, with "PHP" in it's name, which is infact called PHP and uses
PHP licensed code, so maybe php.net is allowed to call there products
PHP ;-)

As a further note:

4. Products derived from this software may not be called "PHP", nor
may "PHP" appear in their name, without prior written permission
from group@php.net.  [...]
[http://www.php.net/license/3_01.txt]

If they would use code licensed under the PHP license and therefore would
be derived work, they could still ask for a written permission, how do you
know they didn't?

johannes

Edin Kadribasic

19 years ago

Roman Neuhauser wrote:

> # ilia@prohost.org / 2007-01-21 18:25:24 -0500:
>
>> Personally I think PHP  related projects should avoid using "PHP" in
>> their name period as it  causes far too many problems for the language
>> itself, since most  people fail to distinguish between PHP the
>> language and project  trying to gain popularity by shoving "PHP" into
>> its name.
>>
>
> php.net distributes programs that violate the PHP license: e. g. PHPUnit
> or PHPDocumentor (see http://pecl.php.net).  If php.net is ok with
> ignoring the license terms (and has been for several years), does the
> license still mean sh!t?
>

PHP license governs how you can use, copy, distribute and make
derivatives PHP. It has no influence on how you call, develop or license
applications that you wrote yourself and own copyright off. It sure
cannot prevent people starting magazines or other publications using PHP
name. So please get your facts straight before making such bold statements.

Edin

Greg Beaver

19 years ago

Roman Neuhauser wrote:

> # ilia@prohost.org / 2007-01-21 18:25:24 -0500:
>> Personally I think PHP  related projects should avoid using "PHP" in
>> their name period as it  causes far too many problems for the language
>> itself, since most  people fail to distinguish between PHP the
>> language and project  trying to gain popularity by shoving "PHP" into
>> its name.
>
> php.net distributes programs that violate the PHP license: e. g. PHPUnit
> or PHPDocumentor (see http://pecl.php.net).  If php.net is ok with
> ignoring the license terms (and has been for several years), does the
> license still mean sh!t?

Um wrong,  phpDocumentor *EXPLICITLY* wrote php group and asked for
permission to use php when we first switched to the php license years
ago.  Get your facts straight before posting rumors.

Thanks,
Greg

Stefan Esser

19 years ago

It should be noted, that the PHP Group is not allowed to give anyone the
right to use PHP in it's product name.
If they do so they violating the Open Source Definition

http://www.opensource.org/docs/definition.php#5

Any kind of discrimination against anyone is not allowed. Giving some
people special rights, like allowing them to use the name PHP in their
Products name, while other parties are not allowed is clearly in
violation with the discrimination paragraph...

But that is old news.

Stefan Esser

Roman Neuhauser

19 years ago

# greg@chiaraquartet.net / 2007-01-23 08:59:46 -0600:

> Roman Neuhauser wrote:
> > php.net distributes programs that violate the PHP license: e. g. PHPUnit
> > or PHPDocumentor (see http://pecl.php.net).  If php.net is ok with
> > ignoring the license terms (and has been for several years), does the
> > license still mean sh!t?
>
> Um wrong,  phpDocumentor *EXPLICITLY* wrote php group and asked for
> permission to use php when we first switched to the php license years
> ago.  Get your facts straight before posting rumors.

If I recall the discussions from several years ago correctly, the provisions
to protect "PHP" were meant to prevent proliferation of programs written in PHP
and called PHPthis of ThatPHP.  So even if a special deal has allowed you to
use "PHP" to endorse or promote PHPDocumentor, it is against the spirit of the
license if not against the letter.

I'd like to get permission to use PHP in the name of my MuchBetterDocumentor,
where do I apply? ;)  http://www.opensource.org/docs/definition.php#5

--
How many Vietnam vets does it take to screw in a light bulb?
You don't know, man.  You don't KNOW.
Cause you weren't THERE.             http://bash.org/?255991

Rasmus Lerdorf

19 years ago

Alain Williams wrote:

> On Mon, Jan 22, 2007 at 10:08:16AM +1100, Rasmus Lerdorf wrote:
>
>> From a bigger perspective, the reason we prefer people to not use the
>> PHP name for their projects, especially modified versions of PHP itself,
>> is that in the extreme case we want to avoid someone releasing PHP 7 on
>> us.  That would confuse a lot of people.  For better or worse, if
>> someone is using PHP they are using code we have control over, so when
>> they report a bug or describe a problem we have a pretty good idea about
>> how to go about fixing it.  If they are using a heavily modified version
>> of PHP, then it becomes much harder for us to figure out what is going
>> on and by asking people to come up with their own brand for such
>> modifications it becomes obvious to everyone involved that there is a
>> different codebase involved.
>
> It is a difficult problem and we need to take care before adopting a stance
> on it, look what happened with the Debian firefox/iceweasle debacle.

It's not really up for discussion.  The decision was reached some 8+
years ago with the adoption of the clause in the license which is quite
explicit.

-Rasmus

Robert Cummings

19 years ago

On Mon, 2007-01-22 at 10:27 +1100, Rasmus Lerdorf wrote:

> Alain Williams wrote:
> > On Mon, Jan 22, 2007 at 10:08:16AM +1100, Rasmus Lerdorf wrote:
> >
> >> From a bigger perspective, the reason we prefer people to not use the
> >> PHP name for their projects, especially modified versions of PHP itself,
> >> is that in the extreme case we want to avoid someone releasing PHP 7 on
> >> us.  That would confuse a lot of people.  For better or worse, if
> >> someone is using PHP they are using code we have control over, so when
> >> they report a bug or describe a problem we have a pretty good idea about
> >> how to go about fixing it.  If they are using a heavily modified version
> >> of PHP, then it becomes much harder for us to figure out what is going
> >> on and by asking people to come up with their own brand for such
> >> modifications it becomes obvious to everyone involved that there is a
> >> different codebase involved.
> >
> > It is a difficult problem and we need to take care before adopting a stance
> > on it, look what happened with the Debian firefox/iceweasle debacle.
>
> It's not really up for discussion.  The decision was reached some 8+
> years ago with the adoption of the clause in the license which is quite
> explicit.

I always found it strange so many projects use PHP in the name. PHPBB,
PHPArchitect, PHP-Eclipse, PHPAccelerator, PHP Nuke, PHP Kitchen...
Sounds like PHP should have been trademarked so that these projects
couldn't legally use the acronym without the consent of the PHP group or
some other oversight group. I mean, PHPBB doesn't exactly help with the
security image of PHP :/

Cheers,
Rob.

--
.------------------------------------------------------------.
| InterJinn Application Framework - http://www.interjinn.com |
:------------------------------------------------------------:
| An application and templating framework for PHP. Boasting  |
| a powerful, scalable system for accessing system services  |
| such as forms, properties, sessions, and caches. InterJinn |
| also provides an extremely flexible architecture for       |
| creating re-usable components quickly and easily.          |
`------------------------------------------------------------'

Hartmut Holzgraefe

19 years ago

Robert Cummings wrote:

> Sounds like PHP should have been trademarked [...]

i don't know about the rest of the world, but here in .de you won't
get a trademark on a 3 letter name anymore, and this has been so
for quite a while, afaict since far before PHP came to light ...

--
Hartmut Holzgraefe, Senior Support Engineer                            .
MySQL AB, www.mysql.com

Stanislav Malyshev

19 years ago

> I always found it strange so many projects use PHP in the name. PHPBB,
> PHPArchitect, PHP-Eclipse, PHPAccelerator, PHP Nuke, PHP Kitchen...

If PHPBB/PHPnuke do not derive from code in PHP source itself, PHP
group, as I understand it, can do next to nothing about it, since no
distribution of materials that have copyright belonging to the PHP group
is happening.

> Sounds like PHP should have been trademarked so that these projects

AFAIK (not being a lawyer) defending trademark is quite bothersome - you
actually *have* to go after all violators or your trademark is void.
Meaning PHP Group would *have* to go after all authors of all
phpWhatever which would lead to a lot of pissed off people and a lot of
time wasted in stirring trouble instead of spending this time to do
something useful.

> couldn't legally use the acronym without the consent of the PHP group or
> some other oversight group. I mean, PHPBB doesn't exactly help with the
> security image of PHP :/

I don't think names are the main problem here...

--
Stanislav Malyshev, Zend Products Engineer
stas@zend.com  http://www.zend.com/

Stefan Esser

19 years ago

> It's a bit of an edge case.  I don't think I ever really considered CSS
> as being part of the PHP source code, but I suppose technically it is.
>

Like I previously stated. The phpSecInfo program does not only steal PHP
code and uses PHP in it's name, it also steals the layout of phpinfo,
including the PHP.net logo+link. This is actually no suprise. The
marketing consortium aka. PHP Security Consortium does everything to
look endorsed by PHP.net.
They also stole the PHP.net favicon for phpsec.org

And the only reason noone goes against this is because these people are
friends of the members of the PHP group.

Stefan Esser