Subject: Re: [sacm] SWID Tags and Open Source Software

From: Steve Klos <[email-masked]>
Date: Tue, 02 Oct 2012 14:27:44 -0700

Lee,

Will try to respond to your queries below.  Using a mobile system, so bear with me as I try do provide in-line comments in bold...

Before proceeding, let me be clear - I'm not a lawyer and my comments should not be considered to be legal advice.  You should talk with your attorney to validate any information being provided in this e-mail.

Can the SWID specs be packaged up into a Debian package, or does the TagVault legal barriers prevent this? I think this is possible with SCAP, and SPDX, but not with SWID. Without base packages like this to depend on, then open source development isn't viable.

The TagVault.org legal barriers are defined by the members and the organization.  The goal of TagVault.org is to fix a number of issues that have been pervasive in the software industry for some time.  As a program, TagVault.org is a non-profit managed under IEEE-ISTO and is not looking to profit from these efforts.  The program does, however, need to do some development and needs computing and networking services to provide the structure necessary to resolve these issues.  I expect that commercial organizations will be more than willing to be members of the program and to help with the definitions.  That being the case, the expectation and desire is to provide as much as is possible in a form that can be redistributed.  

The ISO standard - obviously cannot be redistributed, however the XSD can.  The expectation is that the TagVault.org materials will be able to be redistributed whenever possible.  TagVault.org (and others) can also provide additional materials to help provide context to the XSD structure - it's a matter of time and resources.

Where is data that clarifies what Open Source licenses are viable with content using the TagVault legal restrictions? Can I use GPLv2, v3, BSD, etc with my apps, and include a snapshot of the SWID markup files needed for my open source project?

The direction I would like to move with all tools and source is to utilize Apache licenses to enable commercial use of the source.  You can use whatever licensing you want since the actual SWID tag is an XML file that's based on freely available, storable and redistributable XSD files.  There should not be any issue with including a SWID tag in any software product.

I'm concerned about any IETF use of SWID standards, if you cannot freely access the spec and data without being forced to join their trade group. It seems a step backward from NIST SCAP, and IETF-style standards.

The goal is to provide certification services to commercial organizations and to provide freely available access for materials that open source publishers/users would utilize.  There is a strong desire to support both models and I've not heard anything from the board of directors that would indicate this will change.

I'm also slightly6 concerned with the nontechnical (legal) heritage of SWID (copy protection) and SPDX (IP violations). Hopefully the metadata they create will be not be focused on the agenda of their creators. But with SPDX, the creators control the trade group, and force you to join and agree do help with their agenda... SCAP CPE does not have this legal legacy to deal with, and is strictly focused on technical issues (security).

I do want to be perfectly clear - SWID's have nothing to do with copy protection.  In fact, that was explicitly placed out of scope for the development of the standard and it's not something that TagVault.org has taken up.  It certainly has not been anything that TagVault.org members have indicated they want the program to address either.  The area the standard addresses is authoritative software identification from the time the software leaves the publisher, as it's patched and upgraded and eventually retired.

We are working with commercial vendors to get them to help in the process of setting up the tools, repository, documentation, services, support etc.  If there were a different funding model available that would still allow the program to work as a non-profit organization that will support any program world-wide, I'm completely open to discussing the possibilities.  At the moment, TagVault.org is contracting with companies to create the utilities that validate and sign SWID tags as well as validate the certified tags.  The goal, once we have these services up and running is to provide a parallel structure for open source utilities that will not require fees.

I personally would love to do more to support the open source community, but only have so many hours in the day and have a very limited amount of money for consultants to develop the tools.  If there are some in the open source community who are very interested in supporting this effort *AND* are willing to commit to providing resources to make this happen, I'd be more than happy to work with them and provide information and review efforts.  We can also work through issues of getting these individuals/organizations involved with TagVault.org without requiring a membership fee.  Having said that, every member added to the program requires additional support costs from the program management team, so we're in a bit of a bind - a desire to support FOSS software, but no money available to move forward with that effort...  Suggestions?

I'm very open to creative ideas here.  Thoughts?

Cheers,

SK
408.202.1900
--
Sent from a mobile device. Please excuse brevity and typos.