Java and the dangers of GPL

Don't get me wrong. I am a GPL fan in spirit when it's combined with a linking exception. Initially I applauded Sun's choice for Java's open-source license. I am also grateful for the monumental efforts of Richard Stallman and Eben Moglen in helping move the world of software forward. However, GPL version 3, released two months ago, suffers from 2 flaws, fatal flaws, fatal not only to the healthy evolution of GPL but also to that of Java.

Flaw #1 - The anti-tivoization clause for consumer hardware is a limitation inimical to free software. I agree with Linus Torvalds that this clause is a critical mistake. I may write about this in more detail later, but for now, consider only how this stunts development of security for distributed applications. My objection is not merely practical. My objection is in principle. Freedom in bits, freedom in property, no control over how I use bits in my own property or how others use them in theirs, that's where this world is heading. Dictating what I can or can't do with the software in certain hardware smells of controlliness (yes, that's a word I just made up, but I bet you know what I mean), inimical to the type of flexibility we need to move this world ahead... fast.

Flaw #2 - Here's the clincher, a flaw that even shows a high degree of, dare I say, hypocrisy (Torvalds dared). The license itself is not open to changes. You will be punished if you use a license with flaw #1 corrected. Richard Stallman and Eben Moglen will not let you fork it. I was shocked to find this out. No free-software heretics welcome. You're locked in for the ride no matter how arbitrary the car driver. This is the GPL trap. (See the video below.)

What to do? Sun currently licenses Java under GPLv2 with the linking exception. I do hope that Sun adds another open-source license for Java and does not merely move to GPLv3 unthinkingly. I also hope that the Creative Commons adds another open-source software license to its repertoire. In the meantime, I'll continue to use Java as is, but I'll be keeping my eye on Apache Harmony, though it's currently lacking a Mac version. In the grid world to come, the freedom to securely ensure that software be accountable is essential, no matter where it runs.

I find it sad since I find exciting value in the GPLv3 apart from these 2 dissuasive defects.

Here is an excellent, informative presentation on GPLv3 given by Sapna Kumar in June to the Triangle Linux Users Group. According to Kumar (1:13:03), Stallman will not let you modify the GPL license on your own even if you call it by another name. The Free Software Foundation enforces this through copyright.

Newton Discovery

I've discovered Newton, and now Newton's downloading on my Apple.

Newton uses OSGi for local components and Jini for remote components, combining them both into a distributed component framework, with some SCA thrown in for good measure to describe how to assemble the components all together.

A good starting point to learn about Newton is The Newton Component Model.

Newton is available under a GPL or commercial license.

Here's a presentation on Newton from the 10th Jini Community Meeting last year.

Hat tip: Fun with OSGi

See also: OSGi in a dynamic service grid

French Roast

Well, I've ordered my first French book on Java, Spring par la Pratique.

In his preface to the book, Rod Johnson, the founder of Spring, writes,

The content is not only up to date, but broad in scope and highly readable. Enterprise Java is a dynamic area, and open source projects are particularly rapidly moving targets. Spring has progressed especially rapidly in the last six months, with work leading up to the final release of Spring 2.0. The authors of this book have done a remarkable job of writing about Spring 2.0 features as soon as they have stabilized.

According to one Amazon review, "un must have !" The reviewer, Levy, writes,

Excellent ouvrage, clair, précis, pédagogique et très complet.
Non seulement ce livre expose de manière simple les principaux concepts de Spring (conteneur léger, IOC, AOP, Spring MVC, Acegi security...) mais il aborde également, avec des exemples précis de mise en oeuvre, des thèmes plus rarement abordés dans les autres ouvrages : support d'AJAX et DWR, d'XML et des web services, de JMS, JCA et JMX.
A possèder absolument dans sa bibliothèque si on ne veut pas passer à côté de la révolution technologique qui s'opère autour des architectures J2EE.

Here's my translation of Levy's review,

Excellent work, clear, precise, instructive, and very complete. Not only does this book explain simply the principle concepts of Spring (lightweight containers, IOC, AOP, Spring MVC, Acegi security...), but it also tackles, with specific implementation examples, some topics rarely addressed in other works: AJAX and DWR support, support for XML and web services, and support for JMS, JCA, and JMX.

Definitely a book to have in your library if you don't want to be passed by in the technological revolution sweeping the world of J2EE architectures.

Jini - a new book and a clear interview

Do you want to learn about Jini? Here are two resources for you.

First of all, there's a new book, Foundations of Jini 2 Programming by Jan Newmarch, based on his online tutorial.



Second, at Java Posse there's a 3-part podcast interview with Van Simmons, leader of the ComputeCycles project. Van talks about his grid-computing project and, along the way, gives a particularly clear summary of Jini and how a cabal on Wall Street is preventing you from knowing just how powerful it is.  :)

• Van Simmons interview - Part 1
• Van Simmons interview - Part 2
• Van Simmons interview - Part 3

Update: Here's another presentation by Van Simmons from JavaOne 2006 that goes into more detail on ComputeCycles.

Can AJAX Clean You Out?

If you have Javascript turned on, can a website upload files from your computer without your knowing it? Try any AJAX-based email website, such as Google or Zimbra. Attach a file using the textbox, no dialog, and send the email. If this code can upload a file, then why can't AJAX do the same internally, without the usual social amenities such as asking for your approval?

Zimbra is open source. Whatever they do, anyone can do.

Does this mean that for any website you visit with Javascript on, that website has a wide open straw to your computer? It can't browse (or can it?), but, when it guesses correctly where you have certain files, if I'm not mistaken, it could suck them right up. I hope I am mistaken.

This shocks me. You can install NoScript, which allows you to turn on Javascript for those websites you trust and those websites only. But still, for those you trust, you must trust them utterly. There's no middle ground. There's no sandbox, such as Java has.

Is this a wide open security hole on the client side for AJAX?

AJAX is seductive. Like Paris Hilton, her beauty and riches have gotten her far. But what's this? A DUI?

Update: (20 Jun 2007) Paris and AJAX jostle for attention. :-)

The Mayflower sails - Spring meets Jini

Tom and Chris Cellucci discuss Mayflower at JavaOne 2006. Mayflower is a new open-source project bringing together the worlds of Spring and Jini (and Rio). Last October at the 9th Jini Community Meeting in Chicago I had the privilege of hearing the Cellucci brothers give a presentation on the subject.

Watch this boat. It may settle a continent.

Update - Spring Modules has superceded Mayflower.