Re: Bug#223961: libdvdread3: makes download of possibly illegal libdvdcss too easy

[Adrian Bunk <bunk@fs.tum.de>]

On Mon, Dec 15, 2003 at 11:37:38PM +0000, Brian M. Carlson wrote:
> On Mon, Dec 15, 2003 at 06:50:10PM +0100, Adrian Bunk wrote:
> > On Sun, Dec 14, 2003 at 11:16:11PM +0100, Andreas Metzler wrote:
> > > Adrian Bunk wrote:
> > > > Package: libdvdread3
> > > > Version: 0.9.4-3
> > > > Severity: critical
> 
> This is not a critical bug. This is a serious bug. The definition of a
> critical bug is:
> 
>   critical
>     makes unrelated software on the system (or the whole system) break,
> 	or causes serious data loss, or introduces a security hole on
> 	systems where you install the package.
> 
> The definition of a serious bug is:
> 								 
>   serious
>     is a severe violation of Debian policy (that is, it violates a
> 	"must" or "required" directive), or, in the package maintainer's
> 	opinion, makes the package unsuitable for release.
> 
> I assume, therefore, that your objection is based on policy 2.3, which
> reads in part as follows:
> 
>   We reserve the right to restrict files from being included anywhere in
>   our archives if
>     * their use or distribution would break a law,
> 	* there is an ethical conflict in their distribution or use,
> 	* we would have to sign a license for them, or
>     * their distribution would conflict with other project policies.
> 
> because you did not include a Justification: header. Please state if
> this is not so.


My objection is based on the first half of your
  Our Priorities are Our Users and Free Software

If you want to nitpick, you could try to discuss whether it's critical 
or grave or serious, but it's definitely RC.


> > > > The debconf note says:
> > > 
> > > > <--  snip  -->
> > > 
> > > > Many DVDs use css.  To play these, a special library is needed to
> > > > read them, libdvdcss.  Debian cannot distribute this library
> > > > according to some laws, but it is available on other places on the
> > > > internet for download.  Run
> > > > `/usr/share/doc/libdvdread3/examples/install-css.sh' to download and
> > > > install it.
> > > 
> > > > <--  snip  -->
> > > 
> > > > These "some laws" not only prevent distribution of libdvdcss, they
> > > > also disallow the use of libdvdcss in some countries (e.g. in Germany).
> > > [...]
> > > 
> > > It is rather dubious and not proven in court that using libdvdcss
> > > for *playing* DVDs (not copying them) is indeed illegal in Germany. I
> > > suggest further discussion on -legal.
> > 
> > It's at least a grey area, and most likely in more countries than just 
> > Germany.
> > 
> > If you as a private person say "I think it is legal to use libdvdcss for 
> > playing DVDs", it's your choice.
> > 
> > But for a user, it should be very clear that there are legal risks when 
> > using libdvdcss.
> 
> Ignorance of the law is no excuse. If I choose to use an MP3 encoder in
> this country without paying Frauenhofer and Thomson exorbitant fees, I'm
> taking that risk. Any reasonable user should already know that libdvdcss
> is dangerous, and if one doesn't want one's door battered in by the

I know _many_ Debian users that would after reading the libdvdread3 
debconf note immediately install libdvdcss.

Don't assume every user of Debian knows about the history and legal 
problems of libdvdcss.

> cops, one shouldn't use it. That said, it doesn't meet the standard set
> out above: the use of the install-css.sh file itself does not break a
> law, even though the use of the resulting download might. While this is

If production, import and distribution of some software is illegal [1],
the legal status of a script that downloads such software is at least
questionable.

> nitpicking, this is the standard set out in policy, and is the criteria
> for serious bugs.
>...

Thankfully, I filed it as a critical bug.  :-)

cu
Adrian

[1] That's the case with software that circumvents copyright protection
    in Germany.

-- 

       "Is there not promise of rain?" Ling Tan asked suddenly out
        of the darkness. There had been need of rain for many days.
       "Only a promise," Lao Er said.
                                       Pearl S. Buck - Dragon Seed