French citizen, computer science engineer with 15 years of experience as a web artisan, and also a lot of experience as an online militant activist with big French associations, and also maybe the one you know, la quadrature du net during five years I've been making the press review of la quadrature du net and during this time I dreamt about a tool that could save me 80% of my work clicking back and forth from the newspapers to the press review and I did not find this tool existing I complained a lot about this tool not existing and after some years I finally I finally had the idea to just make it that's how it started so it's a press engine it's a search engine looks like every regular search engine you put your terms you click on the bottom and the results are it's in fact a meta search engine so it's very easy to understand you put your request and the tool will fetch results from now more than 500 newspaper online using their own internal search feature for this to work in a web in a web context I needed to shape it as a web extension to gain more privilege and be able to fetch online content from something else that your own URL and to present it to you on your on your web browser so here are some use cases why you do need a search engine to look into newspapers into online newspapers you can be making a press review but you could also be monitoring a scientific area there are more than 10 sources of meta press among the 500 I already spoke about 10 sources that are scientific editors with online presence but everything you would do with Google news you can do with meta press because meta press is a kind of a hack of Google by the outside and it provides comparable results but without the servers and without the monitoring of everyone the tool is already able to fetch quite impressive quantities of results and it takes not so longer not so long to do and it provides more than just what Google news is offering you because you can custom the searches you can select in which sources you will in which newspaper you will search you can select them by group or one by one and so you know where it has been searching for and where it was not searched while with the Google news you should believe that they search everywhere and you can't check it the tool also lets you reschedule something that was a good search you click on the bottom and you decide if the search should pop up on your web browser every day every week when you want for the accredited unit for me to continue my work at the press review I have just four of them when I arrive at 9 in the morning and just at 11 30 before the break and I have four in the day I'm sure I won't miss any news any result so the main advantage is is that you win all the time that you should spend to query all the newspaper one by one your computer juice does this and it does this very fast there's no private life threats because you can check what the tool does it's a free software you can check what are the queries just looking at the death tool of your web browser you can see that the tool is only querying the newspapers you want and I present this tool presents you the results without loading any side content no tracking no advertisement no pixel hidden it's like the nl net said it's help you to escape the swamps of third parties also if you do twice the same search hopefully you will obtain twice the same results and in the same order and unfortunately it's not the case with all the other main commercial tool to do this they want to trick the order they want to decide what's on the first page and what's not they want to put some ads between it's not the case with this tool your phone if you run the software on your phone will be powerful enough to sort all the results in chronological order if that's what computers are doing the best it's the point that works in French because in French we don't do computer it's not computing machine it's ordering machine with we said ordinateur so it's a lot customizable and sure it's fully decentralized architecture architecture it's your computer that works when you install meta-press your computer suddenly learn how to query all these newspapers nothing is going to meta-press servers there is no meta-press servers it's easy to check no need to come by me to check what the servers are doing there's no servers you are sure to be protected also it means that there won't be easy sensor censorship on the tool it's globally impossible to censor because you you can block one newspaper in one country but you won't block all the things it also means that if tomorrow all even if now all of you are trying to download the thing and install it I won't sleep bad because it's your computer that works and my servers won't be on the knees because four million people start to use it from one day to another this decentralized architecture means that the more people use it the more computer are running it and it needs no new equipment on the network I I don't need to put more servers and more and more servers and to put my data centers on the arctic polar circle like Google there's no servers it's existing machine that just learn to do new things so how to get it it's a web extension for Firefox so just add on to addons.mozilla.org and click the add to Firefox button this one my favorite it will ask you two questions it will wait for a few seconds and then it will ask you if you really want to install it just click yes and then after very important it will it will ask you if you want to run it in private mode my first move would be I don't know what it is I click no and I will see later but unfortunately if you take the problem from another side you're just going through the preferences of Firefox and you see always use private mode why not I want to have some private life so I click on this button and it ends up with you installing something that won't show up because you clicked not in should I you allow it to run in private mode that's that's the only thing that can go wrong and people say I install it and nothing happened bad news but not it's not exactly my fault you should see a new icon in your toolbar with a nice butterfly net catching falling stars it's the news in the newspaper the falling stars and and meta presses the fly net it works also very good in in inter browser if you don't have this icon either you did not allow it in private mode or it's behind the smaller sandwich things like burger icon but the icon is somewhere I just click on the icon and it will open the press the third and you've seen to finish some limits it's it's not the cyber blade that will do everything I try hard but I can only add sources to the tool if the sources provide a meaningful date on each results it means two things a newspaper that would use a search engine that not that is not printing the date of an article in the results the page of the results of the search engine I could not integrate this because I don't have the dates and I can I cannot search it also means that an online agenda for instance a militant agenda that say there will be protest there and over there and this like mobility zone the tool from from a soft can be used and can be integrated and where read with this tool because the results will be sorted by chronological order it works so you can query with this tool the 30 instances of the demo sphere.org online militant agenda and it's the only way on earth to do this it's not very useful because the different instances are for different areas but still if you want to search something it's possible I need a date on the results I only can search through known sources currently there are 538 sources that you can query with the tool only this one can be queried because it requires to produce a set of this some description of the two of the source for meta-press to know how to fetch the results from it so that's a limitation we will need more volunteers to help us to map the world to discover all the newspapers of the world because it's the aim currently there are newspapers from 50 countries 59 languages because I had first for the newspaper of records found in the corresponding Wikipedia page and then I am doing French things because I am French people but for instance the Egyptian newspapers I'm sure there are some great of them but I can't just understand what I see on the on the main page so we need to instruct meta-press about new new sources I also currently can't fetch old archives scientists for instance they would like to be able to deep dive into a subject and to fetch old results and for the moment the tool is only capable of fetching the results of the first page of the search engine and maybe maybe one day the tool will improve but it's not planned yet it's a meta-search engine so the search are taking quite some time in fact you see the first result coming in the first millisecond so you don't see that it's long but to comply completely the search will take about 20 seconds it's still not long enough to print your keyboard in your face like neo in matrix it's not a website should have been should have been better if it have been a website but I need the special privilege and there's no email notification but you have in browser notifications do you have any questions yes I can move yeah so for people with questions there are microphones along the line so Simon can stay up here thank you for the beautiful talk Simon and if anyone has questions the microphones in the middle are available for questions and then Simon can stay up here and answer them very brief one there are journals with behind the paywall like New York Times how do you get in do I get through the paywalls no I am not giving you access to the content of the article I am just giving you access to the knowledge of the existence of the article there exist tools to go through paywalls but my aim is to reinforce the freedom of press my aim is to get the journalist a living and there I don't want to circumvent their business models behind the paywalls it's not a web the web anymore but you know it's exist and you you might just reach the guy and ask for the content or something that's a great question and a great answer the next one hi my question is do you have a lot of problems with the sources changing the way they sent you data back that's a great question and it's sure a weakness of my model the short answer is no it moves slowly from time to time one newspaper is changing is is appearance but they might just change the CSS and not the structure and that would be great for me it happens but it's not the threat for the project another answer is that a lot of newspapers are providing their results on the RSS format you can query it and register for the RSS field a lot of newspapers it's not something good from them because they thought about us it's just because by default in WordPress you get the feature and hundreds and hundreds are using WordPress by default with this feature even if they are not displaying it I check will it pop up how it gets and up next thank you okay well thank you can we have a big applause for Simon come back on Monday 10 a.m. here for the long presentation yes so if you want to know more he's giving another talk on Monday here how what time 10 a.m. 10 a.m. okay so that was beautiful the next speaker can already stand there while I do my little announcements so who's the next speaker okay so I just want to let you know we are doing something about the heat there are people working to get the tent open to get ventilation because it is way too hot in there so don't forget to drink water put on sunscreen even though it's we're in a tent and then for the next speaker his name is Yap van Tiel and he's going to give you a I imagine a really nice talk have fun good afternoon ladies and gentlemen I have ten minutes to save the world so I will be fast and not use the I don't have slides because I was invited yesterday to do this and I can do it from is it can you hear the okay the title is the Liby law method to build networks and you will say the Liby method whatever is that I will explain well first the problem we are going to solve together I hope is caused by a massive interconnection of everything we have built in the world there is appearing a lot of complexity everything is interrelated it's it's our fault also because we have connected all these things but so if there is a single issue a crisis a lot of other fields are involved and should be involved too second thing is it most of these crisis like energy climate migration etc etc are a worldwide issue I have big respect for the people of some groups who agitate against the big companies spoiling our nature but the the jurisdiction is still national and that's silly because it is it should be a planetary issue and we have to approach it in a planetary way now since hackers know what they are talking about learn very fast together and get things working yeah it's very positive usually they can make they they know what you're talking about they can if they combine their efforts can repair and improve things so after the apocalypse which is now yeah and if you look at the meaning of apocalypse means revelation it's not only a disaster it is there are revelations coming I hope I give you one today is we have to take action we have to do certain things and how do we do that with the Liebig law method mr. justus Liebig von Liebig was a German chemical man in 1850 I think everybody in the world was asking how can we improve crop yield because there are famines and some people said more sunlight more water more fertilizers more working at the soil and he said yes it's all of them are right but there's always one factor which inhibits everything it's like if you are in a congestion in the road the first car in the in the congestion this defines the speed of the congestion so politicians shouldn't make all kinds of fantastic measures which work the other way around in sometimes the opposite results from complex systems they should go from one bottleneck to the other and take away bottlenecks take away obstructions that's what we do in networks something is always stopping the traffic and we have to find those spots where it is congested do something about it or bypass it or tunnel it a lot of talks you will hear this week or these days are about such measures to zoom into obstructions but there's one downside if you take away one obstruction the obstruction will move to another place the car which is was keeping the flow from moving if you take that if they can go faster there's another car which takes over the silly role of looking at the traffic blah blah blah and everybody's waiting behind them so it is you have to continue looking at obstructions where they occur zoom in and together with a lot of hackers help it flow again help it to move and that's a very positive activity with that we can construct worldwide collective intelligence with the central authority to act so it is no longer a central complex system with one government or one group of managers who control everything now we see these people having enormous attacks of control hollocks they want to have everything under control which is fiction so you have permission to help build the global brain from such a construction with a lot of people who work together to get things moving and then we will have to get more than 10 to the power 10 it's 10 billion connected people on this planet which form a global brain and our planet will wake up it's Gaia is going to move and it's about now with it 10 billion people bacteria already have more than a trillion bacteria they also exhibit this collective intelligence so our brains contain brain cells which is much more than 10 billion so the puzzle how we can get conscious is at a certain threshold of that number of connected things so let's help to connect the world and people on this planet and just disregard what managers and governments say thank you well thank you for that beautiful talk I'd never heard of that before if there are any questions we have mics in the lane in the middle so if you have a question just walk up to there and then I think Jan can answer it also the next speaker can already stand up and go attach their laptop or anything I write about these things in my blog which is called the connectivist at wordpress.com so please read my blog and then you get it explained in length thank you please pose your question sir thank you thank you for your talk I've got a question regarding how complex systems actually work given that these kinds of systems do require information exchange between agents your proposal is the following that every agent at some point will gain the whole knowledge about the system otherwise we won't be able to control the whole system do you believe it's not a dystopian vision then well the the point is that you can build collective intelligence for instance in our brain it is a miracle that we can see very clear pictures because the lenses are not in our eyes the watery balls lenses are in our brain it's processed it's well you can store certain things in a if you make transforms of it and you can also do correlations a matching so we are looking very carefully at how brains are concerned we don't know very much about it people have been either looking at those consertion have and having it's image processing it's senses combined combine information from various sources which has to be in a in a group and there are all kinds of dangers that there are also fascists can organize themselves in that way and we have already seen some examples of being very well organized right-wing people for instance but they usually have people who are very loyal to the leader and are not selected for the abilities while we as hackers select people on their abilities on their if they are competent in all these political parties there are very incompetent people at the top and that is not a very durable solution even presidents who have been incompetent and maybe the financial rich people have controlled that but now again the Tories in England have selected a lady who is really has a peanut for brains I mean sorry that I'm a bit rude but I'm from the Netherlands and we we are not polite sorry I will not add more to this disastrous discussion but we have to work together with people who are really competent who really know how computers work really can network and connect to each other and work together to build this global brain well I think that's a great message to end it with could we get another applause yeah so the next person I'm going to introduce is Max and he is going to give a very interesting talk on a topic I cannot explain the title of because I physically can't pronounce the words but I'm sure he can so before I repeat drink your water and we're trying to do something about the heat he is going to give a beautiful talk on it have an applause for Max I think I have some technical issues somehow going away in a second I think yeah and would you like me to remind you of how long you've taken or how long you still have left? I think I would be quite nice. Okay we are still working on the issue of getting the laptop but in the meantime to sign up as an angel there I go I turned it off myself so while there are some technical things happening I don't know too much about don't forget to sign up as an angel if you still want to you get a beautiful water bottle I left up my chair and a lovely t-shirt also if you do decide to do trash or parking shifts which they're really nice you get a gorgeous gorgeous batch that you can adhere to pants or vest and they're really pretty so don't forget to do that now we're still not ready okay um don't worry that is a great idea all right is that okay with you yeah well come up who are you well Michiel and what are you giving a talk about? I'm going to talk about stickers and the Nelnet that's saving the internet so it's actually a great combination of things yeah well good luck a applause for Michiel okay so I work for a charity my name is Michiel Lénax I work for a charity called Nelnet Foundation so this year we celebrate 40 years of trying to save the internet so we first introduced it in Europe back in the day actually it's a bit of a fuck-up and so we want to fix it why we're still alive and so one of the things that we do we're an unbeat a public benefit organization so we give money to people that develop open source software and these people actually so first of all maybe you are one of such persons August 1st you can again ask us for money if you work in an open source project just like Simon who presented earlier as one of our projects but there are actually quite a few of them over here at the at the mch choose a better life than working for a corporate overlord work on free open source free and open source software as much as you like to code your heart out and get paid for it basically that's the formula but of course when people do a project they start making stickers and you've seen many of the stickers in a live there's there's whole tables of stickers and at a certain point in time your laptop fills up and this is this is ordered relatively neatly but this is as much as it can take now a couple of years ago smart people came up with an idea why don't we standardize the stickers so I present you hexagon stickers and just just just to make sure that we're not bullshitting we brought about 50 or 60 different designs of hex stickers to the conference you can get them at the Dutch hacker hacker spaces space and you can start your instant collection and the cool thing about this is you can actually if a project becomes uncool they go close source they have Nazis in their team or they don't have Nazis in your team whatever your thing is you can actually rip and replace it and add cool new things that you want which you couldn't possibly do with these 15 layers of stickers that keep getting your laptop heavier so the mission in short is if you're a coder come and work for the internet ask us at nl net dot nl nl net dot nl if you need a job we're looking for a rust coder a communications person and we're also looking for a project manager get a job there as well and get as much stickers as you can and please use this the hex the hex standard for stickers two inch wide the tip at the top if you're looking for it on the internet you will find the spec and it's so much better that's it's a prettier and better world so that's basically it are we are we there yet okay okay yes well the interesting thing about let's not do that you can talk to me the Dutch hacker space is village there's like a big tent there and you can get unlimited supplies of stickers and get your instant like take them for your kids take them for your friends make better and prettier laptops much that was amazing the next person up with tech with everything working again is max right and he is going to talk about fuzzing of cryptographic protocols so a big applause for him so I will be talking about fuzzing of cryptographic protocols today so I'm max this project originally started in France actually at Inria Loria in North Sea so this was kind of my topic for my master thesis and right now I'm continuing this project at trail of bits which is an awesome security company so what's the deal actually so in our modern world we have we already had several security issues in our worldwide web these security standards are usually defined in what we call our seas so there are a lot of specifications out there so for example there's RC 5246 so there already have been a lot of proposals before that and also after that that happens to be the specification for TLS which is basically the protocol which makes our internet secure but just having a specification is not enough you need to have an implementation something you run something which runs on your phone on your on your laptop and this process is quite error-prone so by going from specification to an implementation developers make mistakes and they will continue to make mistakes unless we let machines do their implementation I think so they have been already quite a few security vulnerabilities which occurred during this path so what actually is fuzzing fuzzing is a method for testing implementations so basically what you're doing is you're feeding just random data to programs and see how they react see if they are crashing see if they reach invalid states so this is called black box fuzzing if you if you're just doing random inputs if you're making it a little bit more intelligent then you let your fuzzer learn to generate intelligent inputs by using some feedback from the implementation you're testing so this is very nice for testing simple tools like just a linux command line tools for example but it gets very difficult when when fuzzing or testing cryptographic protocols because protocols they don't just expect a single input they expect a sequence of messages so it's not just plain binary data which they expect so the challenges are that previous cryptographic messages are important for the later steps no protocol later messages no protocol depend on earlier ones and also you're usually not only looking for crashes but you're also looking for whether there are any logical bugs for example if an attacker somehow managed to bypass authentication or downgrade the security of the protocol an example protocol I've been working on is TLS which is quite old already the earlier versions are very bad and right now we are using two modern ones which are both quite secure even though TLS 1.3 is recommended so the big picture in the fuzzer is that the fuzzer generates some input and with this fuzzer you don't generate just stupid random data but you generate some structured data so for example here we have a client hello server hello message those are two kinds of messages which I use no protocol and you're already sending structured data and for example here to open SSL and then we are watching open SSL closely what is it doing did any security violations occur did some attacker bypass the security of the protocol and all of this is inspired by more formal protocol verification I cannot sadly I cannot go very deep into this but basically the idea is to formally model what is the protocol what messages exist and in this model basically the attacker is the network so you're covering all the man in the middle attack scenarios so the attacker is able to inject messages intercept messages manipulate messages so just like in real life conclusions are so this fuzzer is actually able to generate a mess a series of messages we can concretize these symbolic representations these more high-level representations to inputs which open SSL can understand for example that way for example the fuzzer is able to decrypt messages so if you would task a fuzzer to decrypt messages this is kind of not possible with traditional fuzzing and the fuzzer is also able to detect and also that way rediscover previous vulnerabilities so thanks for your time any questions so can you can you actually so there's a tool called very spell which is a symbolic verification tool which is used being used to model TLS 1.2 TLS 1.3 can you actually use the these models to as input because they're formalized and very structured so you mentioned pro-bearer right yeah it's a tool laid on top of it to simplify development but essentially so it's actually the lab which I participated in did develop pro-bearer for was developed there I did take a look at these models in the very beginning and what you kind of pointed out is like the grand plan which Liza had several years in the future so right now it's a lot of work to get to the point where you can execute all of those tracers tracers or messages but in the end we kind of want to have a fully automated tool which just takes some specification for example in pro bearer and then does it met does it's magic and finds all of the vulnerabilities in it okay august first just just apply for a project then if it's a multi-year project yeah all right then thank you very much for a very interesting talk and well then we come right to our next speaker and yeah I actually have to take over from the Herald because she was running out of time and just in case wondering all right so I have no slides just some reminders of what I'm going to discuss with you so my name is Peter van Eyck I have a couple of jobs they're mainly focused on instructing cloud security and cybersecurity so who of you is involved in cybersecurity education in one way or another okay cool I need Dutch people among that okay even cooler so here's the thing that I'm working on together with a couple of people and the purpose of this short presentation is to see how we can work together to create an even better situation now I don't think that I need to explain to this audience the importance of cybersecurity education there's a growing demand growing workforce and if you have any data that's to the contrary I definitely want to know I am one of my jobs is working as a hope to send at a high school Utrecht and I'm responsible for the cybersecurity and cloud education there now what we find is that in a formal education program even in a formal education program a gamified learning works really well and many of you know that as a capture the flag and what we are starting to do together with a couple of hoax hole in the Netherlands is to build a common platform to run that on the the challenge is that an individual school don't doesn't have the resources to do that either to run the platform or to generate another learning content for that so we're working on what we call the joint cyber range dot an L and you can actually look it up it's alive as a bit of a pun to the joint strike fighter of course and the it's it's in development we're actually working with the surf and a couple of other interested collaborators to work on that what I wanted to point out I have a few notes here I think I don't really need to explain to you how that is going to work because who works for CTF and who has CTF experience right and who basically knows what a capture the flag competition is I guess most of you yeah I see most of hands right okay now what we find surprisingly hard to run that ourselves or to run that in a school environment you can have commercial or a non-profit solutions for that but they don't really interface with student systems they they don't allow for proper curation of the of the content from the perspective of teachers and and universities so that's what we're working on and we're not rebuilding everything ourselves or our current prototype is actually based on CTF D running in a Q&A cluster very cool but we would willing to ditch that if there's a better solution and we're working on that as well so wrapping this up you all have other talks to go to if you are just a little bit interested in moving cybersecurity education specifically higher education but also primary and other levels of education ahead either in the Netherlands or in Western Europe or in Europe then come talk to me because we can definitely work together if you want to contribute content that's also something that I really would be interested in figuring this out and with that are there any questions oh that's really first thank you and big round of applause for our speaker here and yeah are there any questions for him there are microphones in the middle just walk up there if not I don't think we actually have another speaker now


How's everyone doing? I'm Max Fills. I'm the lead attorney in the open source program's office for Google. And basically, we're writing a book, an open source casebook. So it's open source because it's about open source. But we're also soliciting help from any attorneys or anyone knowledgeable to help us do the research. We've got a lot of interesting topics that I'm going to talk about. But I want to focus this presentation on a chapter that we just finished on whether an open source license, whether the violation of an open source license is contract breach or copyright infringement. Before I get into it, here are all the standard warnings. I am a licensed attorney. I'm not your attorney. This presentation is not legal advice. And anything I'm going to say, they're my views, my opinions, not Google's. So please don't write a blog post about this, saying that this is Google's opinion. OK, so a little bit about my background. I take open source more transactionally. Although the more I interact with it, the more I kind of, just by osmosis, adopt the free software zealotry, I think. So from a transactional background, I have to deal with open source every day. And I have to deal with it with every subsidiary company. So we're buying open source. We're selling it. We're making it. We're modifying it. We're leasing it from people. We're distributing it. And we're distributing it in physical devices. We're distributing it as part of cloud software. So basically, open source touches every single piece of business that Google's engaged in now. And my efforts don't scale anymore. I have attorneys come to me every day saying I have this little open source issue in a contract. Can you please review it? I have this open source issue in an acquisition. Can you please review it? And this is the main problem that I face. I don't care why. Just give me the answer. Just tell me what I need to do. And that's fine. Like at a smaller scale, I can just say, do this, do that, do this, do that. But what I find is it's really weird, but there's just not a lot of legal analysis that goes into open source counseling. There's tooling analysis. There's definitely the idea that you want to do the right thing. And I think doing the right thing, if that's all you do and you have no legal background, that's an excellent way to start doing open source compliance. Just give people the respect they ask for and try to abide as closely as possible with the terms of the license. But that's not good enough for me because I want to actually dig deeper and figure out why things are the case. Not only that, but I say right here, it's OK to disagree about what licenses mean, but we shouldn't be disagreeing on what the case law is. We shouldn't be disagreeing on what the basic facts are. So hopefully with this open source case book, we're going to publish a few chapters and then solicit your help. Richard, I'm looking at you if you want to help out. I just want to have us, and Karen as well, obviously. I just want to have us all have the same discussion basically. So with that said, here are some chapters. This is the one I'm going to be talking about today, whether an open source license is a copyright or a contract. But there's a lot of cool stuff we're going to talk about. Revocability of licenses, implied patent licenses. This is super interesting and annoying and scary for a big corporation. Is a contributor an employee? I'm not going to answer that today. And hopefully I'll never have to answer that. Also, trademarks really don't get addressed. So hopefully at the end of the day, this is going to be presented in case book format. So it's not going to be another open source book telling you what to do, giving you advice.  I used to like it when I started because it gave me a sense of power. But now it's just incredibly exhausting to keep telling people what the truth is. What I want instead is to kind of work together to share the same way to think about the problems. So I want to pose the cases and the questions in a real case book format. OK, so this is what I'm going to go over today. I'm going to go over two cases. Jacobson v. Katzer and MDY Industries versus Blizzard. Versata is super important here, too. But I want to keep this brief because I want to interact with everyone. So if we have time, we'll get to Versata at the end. We're going to be talking about contract damages versus copyright infringement damages. And if that doesn't make your blood start pumping, it should. Because those two things are extremely different. If an open source license is just a contract between the licenseor and the licensee, then breach of that contract, you're only entitled to what's called substitute performance. Basically, you can't get a lot of money. You can't get a really good injunction.  If all you can do is contract remedies. But if you can see copyright remedies, you can get statutory damages and fringers profits. You can have an injunction on everything that's being distributed. So for the current ways that copyrights enforced and open source licenses are enforced, it's really to people's benefit to try to always make a copyright infringement claim. We're going to focus on the difference between conditions and covenants and this idea of nexus to an enumerated right of copyright. The only background I'll give you here is let's focus on three things. The right to make copies, the right to redistribute copies, and the right to make derivative work. So those are the three things we're going to keep in mind when we say enumerated right of copyright. And in a casebook format, I might just stop the presentation and ask for volunteers to talk about it. Because what I really want to do is leaving you understanding what conditions and covenants are. And I want you to start applying all these different tests to open source licenses. So we kind of examine these things a little more critically. So here are the ground rules from Sun Microsystems v. Microsoft. Generally, a copyright owner who grants a non-exclusive license to use copyrighted material waves his right to sue the licensee for copyright infringement. How about that? That's a really weird ground rule and it's not something you'd expect. Right there, it says the moment you gave a license, your ability to have any claims in copyright are killed. Except if a license is limited in scope and the licensee acts outside the scope, then you can bring an action for copyright infringement. So you can think of an open source license as this box. And if it's non-exclusive, which means you reserve the right to give this license to other people, then any activity the person does can't sue them for copyright infringement unless somehow this box is like cabined by specific language and they violated that. But we'll get into that right now. So Jacob Sinvey-Katzer, who's heard of Jacob Sinvey-Katzer? Okay. So that's good, that's a positive step. Let's actually talk about the holding there and see if we can apply it. So there was this, Jacob Sin was a model railroad enthusiast and he made this open source library as part of JMRI, that was the name of his consortium, to control model trains. And he licensed it under the artistic license. So this person, so an employee of a company named Katzer downloads Jacob Sin's files, incorporates that into their product, I think it's like, I think it was called the railroad commander, and then they distribute it without giving credit or without any of the requirements of the artistic license, including upstreaming modifications. The procedural history, super complex, super weird. It ended up in the federal circuit, which a copyright action shouldn't end up in the federal circuit. But this one did because there was a patent issue, federal circuit had subject matter jurisdiction and got a bite at the copyright question. So this is where we get the whole thing right here. Whether a breach of licenses copyright infringement depends on whether the provision breached is a condition of the license or a covenant. Now I've read this multiple times and I had a lot of difficulty figuring out what a covenant was and what a condition is. So let's talk about that. A covenant is a promise. Okay, so a contract is mutual promises, two mutual promises between people. A condition uses the word if as long as, okay. The court says here that the artistic license creates conditions to protect economic rights. So this was a really weird portion because I think a lot of times people just focus on the conditions versus covenants issue and they don't go into how much the court found a fundamental need to connect this to some kind of economic right of copyright. So basically if I say you can use my software and please promise to redistribute it. That's a covenant, okay. If you don't do that, I can only get you for contract breach. I can't really enforce it in an aggressive way against you. However, if I say here's my software and you can make derivative works, you can redistribute it only as long as you do these things, then that's a condition. If I condition the grant of rights, then I can get at you because if you violate that condition, you're outside the scope of the license and then that's a real enforcement hook. But I'm just gonna highlight this because again it's lost. The court didn't just say that it's about conditions like because then every open source license would just be if, if, if, if, if, if, if. Like you could just litter them with conditions and then be secure in the idea that you can enforce copyright remedies. But it kept trying to go through every single element of the artistic license and tying each condition, somehow to a fundamental economic right.  All right, so I talked about this. Covenants versus conditions. This comes back in a later case. Is anyone familiar with MDY v. Blizzard? Oh, okay. Anyone else? Okay, just to cut, much less than Jacobson. And this is kind of what's upsetting as an open source lawyer is just, well, that's not upsetting, it's an opportunity. People know one or two cases, they haven't read them in a long time and then that's the end of it. But the idea with an open source casebook is it's constantly updated, always reflecting the most recent law. So MDY versus Blizzard's a really interesting case. Has anyone ever played World of Warcraft? Okay, so more people have played World of Warcraft than know that that's good, that's expected. Apparently it's a real, I used to play Ultima online but I never played World of Warcraft. But I know from MMOs, it's a real pain to level up a beginning character. So MDY makes these bots. I'm sure you've all used these bots or at least some of you have used these bots to just grind the character at the beginning so their level goes up. Blizzard hated this because they thought it was reducing the value of the game. They structured it in a very specific way. They sued MDY for contributory copyright infringement. Now I don't wanna get into the weeds too much but you can only find contributory copyright infringement if the person who did the thing is guilty of direct copyright infringement. So the question is, all right, if you run a robot to grind some World of Warcraft levels and you violate the terms of the EULA, are you committing copyright infringement? It's a weird question. The court was, the court said, absolutely not. No. So here we have the holding from MDY. The potential for infringement exists only when the action of the licensee exceeds the license's scope but then really zoom in on here. In a manner that implicates one of the licenseeer's exclusive rights of copyright. For a licenseeer's violation to be infringement, there has to be this nexus between the condition and one of the licenseeer's exclusive rights. So even if you make the argument that Blizzard didn't sell World of Warcraft but merely licensed it to people, Blizzard has a copyright right to grant people a license to copy the software, to make derivative works of the software but nowhere in any copyright law does it say you can't use bots. So the court found that that failure of that condition meant you couldn't sue players for copyright infringement here. I think I'm okay on time so I'll just add another wrinkle to this before we go into discussion, like open discussion with the audience. So AmeriPrize versus Fasada. It's a very recent case in the Western District of Texas. It's a really cool case but it kind of deals with this at a slightly different angle. So there's this idea in United States federal law called preemption. It says if you have a state law claim and a federal law claim, the federal law claim may preempt the state law claim meaning that federal law trumps state law. So the question there is, is an open source license a contract? Or does it sound in copyright? And you gotta go read Versada because it's a fundamental reading if you're into this sort of thing. But it held that for the purposes of preemption, the GPL was not preempted by copyright. So all that means is that you might be able to sue over the GPL in copyright but you can't just go automatically say that there's only copyright issues at issue in the GPL. And the reason for that kind of lines up with the tests in MDY and the tests in Jacobson. It lines up because it says, okay, first of all, there's preemption if the thing you're talking about is a copyright right. But also they have this thing called like a next element test or a supplemental element test. The court held in Versada, the GPL has something extra, something extra that we don't like because it's this extra thing that's supplementary to copyright that means that we can't just say it's preempted. Okay, so that said, let's talk about this. Let's analyze some common open source licenses with this lens, with this Jacobson test and this MDY test. So first of all, MIT, right here, subject to the following conditions. So the court in Jacobson was really persuaded by using the word conditions. We know immediately that, that is gonna really get them going. What do people think? Is this a covenant or a condition? Does that, yeah, I'm just opening it up. So the above copyright notice and this permission notice shall be included in all copies of the software. Covenant or condition? This is subject to the following. The line above says, subject to the following conditions, which to me suggests it might be a condition. Yes. You know. Yes. Round of applause, wonderful. Oh, let me go back. Yes, so that is, well, that's the exact reasoning that the court in Jacobson would use. They were very persuaded by the word condition. So that's the Jacobson test. Now let's spice it up. The MDY test. Is there an essential nexus between this condition and the licensor, one of the licensor's enumerated rights of copyright? That's a very, yeah, it's a puzzle, you have a puzzled look on your face. It's a weird question. So let me rephrase it. We said the essential rights of copyright boiled down to copying, being able to copy something, redistribute it or make derivative works. Is this condition connected to one of those three things? Wait, did you call on someone? Yeah, sure. Yeah. Wait, wait, wait, wait, wait. I was gonna take it a different direction and say this is, this example shows why MDY is bullshit, which has been my view of MDY, is it took a ridiculously simplistic view of, it completely falls apart under any sort of, any kind of, under many, many licenses, even not counting open source licenses. So to me it's kind of just a wrong decision. Sure. So, let me address that for a second. I love that. The concept that MDY is bullshit, that's extremely helpful because at least we're both talking about MDY being something that we have to look at. And so yeah, I might agree with you, but the pushback I have there is, you say that, I think it really tracks with Jacobson actually, because the essential nexus to one of the enumerated rights of copyright, I'm persuaded, I see the analogy to an economic right like the court Jacobson was talking about. Right, so again, it's all just rhetoric. So, and I pointed this out, yesterday with the Creative Commons licenses is the one commonalities attribution which is not one of the exclusive rights of copyright. And yet, we accept that as a very valid, I also prefer to think of it, not as the economic right, which is what Jacobson did, but it's just fricking consideration. It's nothing more difficult than consideration. So then, when you look at it as consideration versus an economic right, then it's very simple. Yes, there's consideration, tell me who the author is. That's the only thing I'm getting out of this grant is acknowledgement of my authorship. And that's very significant consideration. So then I guess I reject both cases. So, I guess in this it would be a copyright, excuse me, a contract and not a copyright license, senior interpretation, the MIT license. Cause you're talking about, it's copyright license. Wait, wait, wait. Well, certainly I'm, yeah. Here, I'll take, yeah, and then I'll have. I mean, do we want to go down the fact that I also kind of disagree with this whole, this world that there's sort of this concept that there's a license is simply a form of a contract. I don't think a license is a whole different sort of unicorn. It's just a unilateral license. So then that's why, and it's a copyright license. I mean, it's a contract. You get to use my copyright in exchange for you giving me attribution. There is consideration for both parties. I just don't see that. And maybe part of it is I just don't see the point of sort of this copyright versus contract question altogether. I can reject the premise of the talk. Yeah, let me keep going and I'll have some. I'll have some time for questions. Just give me one second. So, yeah, that makes sense. I don't think we should necessarily divide licenses from copyright. I'm just actually presenting the cases, talking about the whole things and saying like, no, don't, don't shut up. Collaborate with me and let's, yeah, let me hear your dissent in a casebook. So we can ask the same question. Let's go to the really interesting things. The anti-tevoization provision in GPLV3. So yes, under Jacobson, this is conditional, right? Because the GPLV3 says you can use this as long as you follow these conditions. But, and Pam, I think I know what you're gonna say here, but I see less of a connection to a right of copyright here. In fact, I see no connection to a right of copyright. So just to conclude, and then we can have a little bit more open discussion. A lot of license obligations can be found to be merely contractual under all the available cases we have on the topic. They don't tie directly to an enumerated right of copyright. They fail the extra element test in Versata for preemption. But I wanna end maybe on a more hopeful note, which is just dovetailing with Bradley's keynote yesterday. So lawsuits are a tactic, right? To advance free software. They're not the end goal. Most of us don't enjoy law and lawsuits. I love lawsuits. I'm obsessed with law and lawsuits. But if we analyze this, then we just gonna have to change our tactics, right? Because if the tactics of free software depend on making copyright infringement allegations and getting huge returns like McCarty is kind of trolling, then that might need to be changed. But if the point is, and I say this at the end, the point is really get community norms and pressure and other alternative regimes besides just copyright infringement lawsuits. Like, if you're not just trying to make millions and millions of dollars, there's a lot of ways to achieve the goals of free software. But at least I wanna situate the tactics we use in actual case law. So that's it. And you can email me at xam.google.com if you wanna participate in the casebook. And I have a couple minutes. So yeah, some questions? Talk about a stand up. Yeah, please. I really like your idea of having an open casebook. It gives me a sense that even though I'm not a lawyer, maybe as a legal geek, I could participate in some way or at the very least learn more about the findings and the understanding. And then of course I really like what Pam did. And it made me think, could this, would this, do you want this to be a collaborative place for us to share that kind of dissent in discussion? Yes, absolutely. More power too. I should say I should have given credit. So Dash over now is my colleague in the Up and Source Programs Office. He's a brilliant attorney. We argue constantly. And that argument has formed the substance of the casebook. The way that's presented, yes, we're gonna invite lawyers but we're also gonna invite just any geeks that wanna contribute. So the format is just gonna be case excerpts and then discussion. Case excerpts and discussion. So there's not gonna be any real conclusions except summarizing the whole things in cases. So everyone's welcome to submit cases that think are relevant for the particular portions. And if you have a dissent, that'll just go into discussion. Cause the point is to have a unified document that kind of trains up everyone's mind. And we want them to see the world the way we have learned to see it over time. Questions, yeah? Yeah, so I get the impression this is gonna be focused very much on US law. Is that right? Ah, great, great. So I just wanted to follow up on that. Now I'm not a lawyer. I'm an occasional litigant with some success. In UK law, there's a thing called the Contracts, Rights of Third Parties Act. Which is kind of interesting. If you read the GPL with that act in mind and you think the GPL is a contract and not just a license, it's possible that end users might have the right to sue for compliance. And nobody, I mean, nobody that I know who has been seriously involved in GPL enforcement is familiar enough as far as I can tell with UK law to even have properly considered whether that's true or not. Yeah, that's a fascinating point. So I, Please do. Okay. I think there would be a privity analysis that'd be a little bit weird.  Do you mind if I respond to that point directly? I'm in English. Yeah, sorry? Just a little quickly. Yes. Yeah, no, no, no, no. Yeah, yeah, I appreciate that. Yeah, no, I'm an English lawyer and I think that's a really good point. But I think it's possible to analyze the GPL as purely being a bare license in which case the contract rights of third parties act doesn't apply. And the reasoning behind that is equivalent to the reasoning in a case called Robinuran Classic FM which I don't have enough time to explain to anyone. So if you want to talk to me about it later, I'm happy to have a chat with you. Yeah, so we're going to start with a focus on American law just because we want to get the thing off the ground. But I definitely want to tackle European specific issues like moral rights. So when a US copyright attorney, open source attorney hears moral rights, they just like put their fingers in their ears. This is the last question. But, yeah, please. I think your initiative for this open casebook is really awesome. What about extending that to discussions on the text of the licenses? Because I'm working day and night on open source software and their licensing. And I work a lot with lawyers, which most of the time, even though I'm not lawyers, I have to educate on the topic. I think some reference discussion on casebooks is going to be already something that's going to make their life much, much easier. And my life much easier. Having the same kind of discussion on the common open source licenses, which are scattered around would be a great, great, great thing to do, I think. So let me address that specifically because I disagree with you a little bit. Because I think there's already an abundance of everyone sounding off on what they think an open source license means. Lawyer or not lawyer? I think what we really need, though, is to agree and discuss the cases and to just get the questions flowing so that we can actually see what the state of the law is. So if there were to be a discussion of open source licenses, we'd do it in such a way that they'd be grounded in the particular case and the particular thing. So what I don't want to have is more facts that people start citing to say, this is what it means, this is what it means. I want people to think instead of to provide them conclusions so that they can short-circuit actually thinking about the issues. Thank you.


Hello and welcome to the International Daily Roundup by People's Dispatch, where we bring you major news developments from around the world. Our headlines, Andres Arauz wins first round as Ecuador heads towards a presidential run-off election. Iran once again reaffirms commitment to nuclear deal, mass protests against military coup continue across Myanmar, and Chicago City government announces tentatively a lower school reopening. In our first story, progressive candidate Andres Arauz has won the first round of Ecuador's presidential elections. Arauz is secured 31.74% of the votes as per the quick count conducted by the National Electoral Council. Given that no candidate has crossed 50% threshold or received 40% of the votes for the 10% lead, a run-off election will be held on April 11th. However, it is as yet unclear who will challenge Arauz in the second round. As per the latest reports, the margin between the second and third candidates is extremely narrow, making the results too close to call. As the vote count continues, here is a video feature on the election results. Khatullah Khamenei on Sunday, February 7th affirmed the country's commitment to the JCPOA, also known as the Iran Nuclear Deal. He said that Iran would, to quote him, return to the JCPOA obligations once the U.S. lifts its sanctions in action, and not in words, or on paper, and once the sanctioned relief is verified by Iran. Khamenei was addressing officers of the Iranian Air Force on the occasion of the anniversary of the defection for the monarchy and joining the Islamic Revolution in 1979. Khamenei emphasized that Americans and Europeans have no right to set any conditions of their own on Iran as they have violated the rules of the JCPOA themselves. He was replying to the U.S. Secretary of State Anthony Blinken's demand that in order for the U.S. to join the deal again, Iran has to first return to all its obligations under the JCPOA. The JCPOA is signed by Iran and the U.S. along with five other countries in 2015. However, Donald Trump, claiming that the deal was too one-sided in favour of Iran, withdrew from it in 2018 and imposed multiple sanctions on Iran under its so-called maximum pressure campaign. The aim of this campaign was to force Iran to renegotiate the deal, including its missile program and regional policies. Tehran, after giving due warning to the European signatories to abide by the deal and take effective measures to protect Iran from American sanctions, started reverting some of its commitments to the deal last year. It is maintained that all these steps are under the provisions of the JCPOA, and once the U.S. rejoins the deal and lifts sanctions, it will come back to full compliance within days. Antico-resistance continues to intensify in Myanmar as mass protests entered their third consecutive day on February 8. Thousands of people, including members of Labour unions, government officials and healthcare workers gathered on the streets of Yangon today. Massive protests were also held in the capital city with tens of thousands of people in attendance. Police forces launched water cannons to disperse the crowds at some sites and the military has wanted that action will be taken against those who break the law. Martial law was also declared in parts of the capital of Pantalei. The order has banned large gatherings and protests and a curfew has been imposed from 8 p.m. to 4 a.m. Activists are calling for a general strike as part of the nationwide civil disobedience campaign. Doctors and healthcare workers have also issued a call to strike last week and stopped work across 30 towns. Teachers, government workers and government employees have also joined the protests. The military has suspended internet services at restricted phone lines on February 6. However, telephone and internet services were partially restored the next day. Restrictions had also been placed on social media platforms including a bloc on Facebook till February 7. Local activists groups have estimated over 160 people have been detained so far. Protesters are demanding a restoration of the elected government as the military continues to contest the 2020 election results. Depostate councillor Aung San Suu Kyi and the President have been placed at a house arrest in the capital city. Both are also facing criminal charges and have been remarried in custody till February 15. Several lawmakers from Suu Kyi's party have also defied military orders to vacate their living quarters in the capital city. These members proceeded to swear oaths of office and held a parliamentary session within their living quarters on February 4. Myanmar has been placed under state of emergency for one year and all power has been handed over to the Commander-in-Chief. And finally we go to the United States where the Chicago city government has announced a tentative deal for reopening schools. The announcement was made on February 7, a day before the schools were scheduled for a limited reopening. The tentative agreement follows months of organizing by Chicago's teachers for a safe return to school amid the COVID-19 pandemic. The Chicago school district is the third largest in the US with over 355,000 students enrolled in 642 schools. The deal requires ratification before February 11 when a phased return to in-person training has been scheduled. According to the deal, in-person schooling for preschool and special education students will start from February 11. Students in kindergarten to fifth grade will return to schools on March 1, followed by those in sixth to eighth grade from March 8. The government has also assured vaccination for 1,500 school staff members per week. Teachers who themselves have health conditions or live with family members who do will be allowed to teach remotely. Parents will also be given the option to choose between in-person or online learning. While the deal provides temporary relief, the Chicago teachers' union has won that a permanent deal with the Chicago Public Schools Board and a city government is yet to be reached. The union has stated that negotiations over federal safety guidelines and other important issues regarding the reopening of the schools will continue. That's all we have time for today. We'll be back tomorrow with more news from around the world. Until then, keep watching People's Dispatch.


Sorry, I'll leave just just a minute. Just a quick question just to check if we could have access to those slides Xavier if you could send all slides, you'll be lovely because they were very interesting. Yes, I can circulate the slides. Okay So now Just we have just seven minutes left. I I Very very do crawl some comments on what we heard and what the key messages you want to Together sorry just two minutes. I Want to follow up on what? You both said first now under I Fully agree with you. We are much more or too much European Centrate for sure. We are talking about Europe. We think that the war in Ukraine is Yes, it is a very important war but Outside Europe. They have a complete different vision and I fully Support what you said I spent Much of my time in Asia and it's true that the debate is completely different for sure Something I want to tell you it is important to use what we have nowadays especially in Asia, India is a member states of United Nations Economic Commission for Asia Pacific Three weeks ago. I was there. I followed the entire week I'm sorry to say but India was Completely absent. So this is really the place that you have to use if you want to raise your voice and what you mentioned from the Global South it is absolutely true But we had only a China who knows how to raise the voice Southeast Asian Asian countries, but It's very important What the discussion we have here we need to use what we have and we need to be present It's the same for the European Union. We are centred on the European Union outside European Union Nobody is Following what's going on and just to what you mentioned about nuclear It's never mentioned in the UN absolutely never I I'm Paid by Gas companies because I'm the director of the global gas center, but I'm struggling to defend nuclear I'm struggling to defend gas renewable gases It's not only renewables We are only talking about renewables at the UN at the cop, etc And this is a disaster for the global itself. This is a disaster for just what you mentioned here for even the citizen from Let's say the north or west or how you call it you want and it's a completely disaster But we have to be here. We have to occupy the field. I was at this Conference at the UN I was we were on I was supported only by Russian Federation and Central Asia to have one paragraph on natural gas and the role in the energy transition So the the Mamba state they have to be here and to defend because only to be to be only present in Brussels It's not enough. I'm telling you it's not enough at all and this is only What is we see everywhere? So I just I'm correct all your your your Mamba state to raise your voice Where and use a multilateralism? Institution that we have it's so important. Yeah Thank you for this Very strong comments