dcc: [26896] terminated: exit 241

Post by Micah Anderson
Apr 9 22:31:14 spamd2 spamd[2774]: dcc: [26896] terminated: exit 241

what version of dcc are you running?
what did you upgrade?
--
Michael Scheidell, CTO
Phone: 561-999-5000, x 1259

Post by Micah Anderson
*| *SECNAP Network Security Corporation

* Certified SNORT Integrator
* 2008-9 Hot Company Award Winner, World Executive Alliance
* Five-Star Partner Program 2009, VARBusiness
* Best Anti-Spam Product 2008, Network Products Guide
* King of Spam Filters, SC Magazine 2008

______________________________________________________________________
This email has been scanned and certified safe by SpammerTrap(r).
For Information please see http://www.secnap.com/products/spammertrap/
______________________________________________________________________

Micah Anderson

2010-04-15 21:35:49 UTC

Post by Micah Anderson
Apr 9 22:31:14 spamd2 spamd[2774]: dcc: [26896] terminated: exit 241

what version of dcc are you running?

This is version '1.2.74-4' from Debian... but now looking closer, it
seems as if dcc was removed after Debian Etch. It seems that it was
removed because the upstream authors changed its license to non-free
(according to Debian's DFSG) in version 1.30. This also means that it
has not been available in Ubuntu either since Dapper.

"The Distributed Checksum Clearinghouse source carries a license that is
free to organizations that do not sell filtering devices or services
except to their own users and that participate in the global DCC
network. . . you may not redistribute modified, "fixed," or "improved"
versions of the source or binaries. You also can't call it your own or
blame anyone for the results of using it."

So I guess I just will remove dcc, that is a shame, it seems like a good
service.

Post by Michael Scheidell
what did you upgrade?

Sorry, I upgraded from Debian etch to Debian Lenny, along with that came
an upgrade to spamassassin.

micah

--
"It is no measure of health to be well adjusted to a profoundly sick society." - J Krishnamurti

Bowie Bailey

2010-04-16 12:49:55 UTC

Post by Micah Anderson
This is version '1.2.74-4' from Debian... but now looking closer, it
seems as if dcc was removed after Debian Etch. It seems that it was
removed because the upstream authors changed its license to non-free
(according to Debian's DFSG) in version 1.30. This also means that it
has not been available in Ubuntu either since Dapper.
"The Distributed Checksum Clearinghouse source carries a license that is
free to organizations that do not sell filtering devices or services
except to their own users and that participate in the global DCC
network. . . you may not redistribute modified, "fixed," or "improved"
versions of the source or binaries. You also can't call it your own or
blame anyone for the results of using it."
So I guess I just will remove dcc, that is a shame, it seems like a good
service.

According to the quote above, the service is free to almost everyone
(even ISPs). Why can't you continue to use it?

--
Bowie

Michael Scheidell

2010-04-16 14:45:42 UTC

Post by Micah Anderson
M
"The Distributed Checksum Clearinghouse source carries a license that is
free to organizations that do not sell filtering devices or services
except to their own users and that participate in the global DCC
network. . . you may not redistribute modified, "fixed," or "improved"
versions of the source or binaries. You also can't call it your own or
blame anyone for the results of using it."

Which seems silly for debian to remove it, since many of the blacklists
in SA are by default, licensed similar (free for non commercial use,
paid if > xxx queries). maybe debian should look through and remove ALL
'dual licensed' software, and when you install SA from the RPM's,
disable the dual licensed RBL's.

Or, hey, lets pretend the people installing debian are smart enough to
be able to make up their own mind if they fit the free license model.

Post by Micah Anderson
So I guess I just will remove dcc, that is a shame, it seems like a good
service.

it IS a good service, and SA 3.3x supports the reputation query directly
now in the commercial license.
Some things to understand, (normal language vs legal talk)

* if you are doing > 100,000 queries a day (100,000 emails a day hit
SA, and thus dcc), its a lot better, and faster to use a local dcc
server.
* If you are using the public servers, their is a built in 1000ms
delay (so if you are using < 100K queries a day, its faster to use
the commercial service)
* public servers don't have the reputations scores (see new scores
for dcc..). double the accuracy.
* if you are an isp, just using it for your customers, you don't
need to pay for the commercial license (no reputation, still
1000ms delays to public servers)
* (but you still might want to. its CHEAP, faster by 1000ms per
query, and with DCC reputations, more accurate)

DCC reputations not only allows SA to score on the fuzzy checksums of
the emails, but score on the 'bulk vs non bulk' reputation of the
sending ip.

zero day spams (bulk!) from known bulk sources can be picked up immediately.
zero say zombots with known spam (bulk) using a new ip can be picked up
immediately with old scores.

the combination of this makes it very accurate, both with catching new
bulk providers, and cutting down on FP's.

did I say its CHEAP, and if you are an isp using it for your own
customers you don't need a license?
If you aren't an appliance vendor

you own it to yourself to at least ASK vernon how much.

(disclaimer: I don't sell DCC, don't know why I am advising competitors
to use DCC since it is one of our advantages, but I like the product,
the service and I like vernon)

*

Post by Michael Scheidell
what did you upgrade?

Sorry, I upgraded from Debian etch to Debian Lenny, along with that came
an upgrade to spamassassin.
micah

--
Michael Scheidell, CTO
Phone: 561-999-5000, x 1259

Post by Micah Anderson
*| *SECNAP Network Security Corporation

Micah Anderson

2010-04-21 15:23:37 UTC

You misunderstand Debian's role and license guidelines. Debian is a
software distributor, and as such it is not silly for Debian to stop
distributing software (ie. dcc) when distributing that software violates
its rules. The blacklists enabled in SA by default are not software,
they are simply hostnames that the Spamassassin software
uses. Configured hostnames are not distribution restricted, and arguably
not even 'software'. There is no software distribution restriction
involved in having those blacklists enabled in SA that violates Debian's
software distribution terms. The software that is distributed is
Spamassassin, which has a fully compliant Debian software distribution
license, not the blacklists that are enabled by default in Spamassassin.

The blacklists do have a restricted use license, but that is something
else altogether.

The software 'dcc', is software, and with it carries a license which
restricts its distribution, and thus Debian, as a software distributor,
has to make decisions based on its own policy, if it is willing to
accept such a distribution restriction. Debian has the DFSG, which is
its guidelines for what is acceptable for distribution, and the license
that the software 'dcc' carries does not satisfy those criteria.

Post by Michael Scheidell
Or, hey, lets pretend the people installing debian are smart enough to
be able to make up their own mind if they fit the free license model.

People are free to do that, Debian wont distribute it for those people,
but people are free to put whatever they like on their systems.

Post by Michael Scheidell
it IS a good service, and SA 3.3x supports the reputation query
directly now in the commercial license.
Some things to understand, (normal language vs legal talk)

I believe it is a good service. If I could get updated software, with
security upgrades, from Debian, I would use it.

micah

Ted Mittelstaedt

2010-04-21 17:25:04 UTC

Actually it's not even that. The notion that Debian spent effort
detecting and removing DCC source is rather farfetched.

Because Linux distros are so large, many freely available
commercially-licensed apps - such as device drivers - some of which also
do not carry "your allowed to distribute this" licenses, get "sucked up"
into the distributions.

Some of this happens by users contributing them and not reading the
licensing closely enough, but quite a lot of it happens by commercial
companies deliberately inserting their stuff in the distros.

This is generally regarded as a win-win by everyone. The commercial
companies benefit because of reduced support calls by people using their
stuff, and by the free advertising that their stuff enjoys, and by
increased sales of ancillary hardware their stuff works with. The users
benefit because they don't have to separately obtain and install the
stuff.

It's also generally understood that if a commercial app seller doesen't
like it they have the right to complain and get an immediate cessation
of inclusion of their apps in a distro. That is why I suspect happened
here.

Distributed Checksum Clearinghouse quite obviously feels that they have
captured enough fishes in the ocean and are making plenty of money now
and so do not require all of the free advertising that inclusion of
their source in Debian gives them. Quite obviously they complained and
their stuff was withdrawn as a result.

Ted

Michael Scheidell

2010-04-21 17:39:16 UTC

Post by Ted Mittelstaedt
Distributed Checksum Clearinghouse quite obviously feels that they have
captured enough fishes in the ocean and are making plenty of money now
and so do not require all of the free advertising that inclusion of
their source in Debian gives them. Quite obviously they complained and
their stuff was withdrawn as a result.

'Quite obviously'? Gee, since I know a lot more of the background
information on this, I would challenge your evidence.

The DCC author would welcome Debian replacing the old, broken code with
something new.
He personally supported the efforts of the FreeBSD ports maintainers in
making sure that current DCC code is in the FreeBsd Ports tree.

He is currently working on re-writting the DCC.pm for SA 3.3.x to make
it faster and more stable.

Or is it your debian folks just forgot to update it?

As was previously posted (by someone else) DCC is free for most
everyone, including ISP's who use it in their mail servers to protect
their own clients.

So, put your money where your mouth is. Why won't debian fix their
broken RPM? someone official from debian want to chime in?
--
Michael Scheidell, CTO
Phone: 561-999-5000, x 1259

Post by Ted Mittelstaedt
*| *SECNAP Network Security Corporation

Stefan Hornburg (Racke)

2010-04-21 17:55:56 UTC

'Quite obviously'? Gee, since I know a lot more of the background
information on this, I would challenge your evidence.
The DCC author would welcome Debian replacing the old, broken code with
something new.
He personally supported the efforts of the FreeBSD ports maintainers in
making sure that current DCC code is in the FreeBsd Ports tree.
He is currently working on re-writting the DCC.pm for SA 3.3.x to make
it faster and more stable.
Or is it your debian folks just forgot to update it?
As was previously posted (by someone else) DCC is free for most
everyone, including ISP's who use it in their mail servers to protect
their own clients.

For most everyone is the key point here. IMHO software in Debian's main
repository is required to be "free" for really everyone, amongst other
things you can lookup in the DFSG.

Open Source is not really open if you disallow certain people or
companies to use and modify it in the public.

Regards
Racke

--
LinuXia Systems => http://www.linuxia.de/
Expert Interchange Consulting and System Administration
ICDEVGROUP => http://www.icdevgroup.org/
Interchange Development Team

Michael Scheidell

2010-04-21 17:56:50 UTC

Post by Stefan Hornburg (Racke)
For most everyone is the key point here. IMHO software in Debian's main
repository is required to be "free" for really everyone, amongst other
things you can lookup in the DFSG.
Open Source is not really open if you disallow certain people or
companies to use and modify it in the public.

what about mysql?

Post by Stefan Hornburg (Racke)
Regards
Racke

--
Michael Scheidell, CTO
Phone: 561-999-5000, x 1259

Post by Stefan Hornburg (Racke)
*| *SECNAP Network Security Corporation

Stefan Hornburg (Racke)

2010-04-21 18:03:53 UTC

what about mysql?

The part of MySQL which is used in Debian (the code without the manual)
is licensed under GPL.

Regards
Racke

--
LinuXia Systems => http://www.linuxia.de/
Expert Interchange Consulting and System Administration
ICDEVGROUP => http://www.icdevgroup.org/
Interchange Development Team

Michael Scheidell

2010-04-21 18:05:16 UTC

Post by Stefan Hornburg (Racke)
The part of MySQL which is used in Debian (the code without the manual)
is licensed under GPL.

so, the same with DCC.

Debian picks and chooses.

mysql seems to have the exact same restrictions as DCC (actually, DCC
looks more flexible)

Post by Stefan Hornburg (Racke)
Regards
Racke

--
Michael Scheidell, CTO
Phone: 561-999-5000, x 1259

Post by Stefan Hornburg (Racke)
*| *SECNAP Network Security Corporation

Jonas Eckerman

2010-04-21 23:01:45 UTC

Post by Stefan Hornburg (Racke)
The part of MySQL which is used in Debian (the code without the manual)
is licensed under GPL.

so, the same with DCC.

Not as far as I can see. At both <http://www.rhyolite.com/dcc/> and
<http://www.dcc-servers.net/dcc/> they link to another, non-generic,
license.

Quote about the free license from the general info page:
---8<---
You can redistribute unchanged copies of the free source, but you may
not redistribute modified, "fixed," or "improved" versions of the source
or binaries.
---8<---

The actual license says:
---8<---
This agreement is not applicable to any entity which sells anti-spam
solutions to others or provides an anti-spam solution as part of a
security solution sold to other entities, or to a private network which
employs the DCC or uses data provided by operation of the DCC but does
not provide corresponding data to other users.

Permission to use, copy, modify, and distribute this software without
changes for any purpose with or without fee is hereby granted, provided
that the above copyright notice and this permission notice appear in all
copies and any distributed versions or copies are either unchanged or
not called anything similar to "DCC" or "Distributed Checksum
Clearinghouse".
---8<---

Wich is more permissive than the info page indicates, but it's not the
GNU General Public License.

Debian *might* be able to distribute DCC under another name, like they
did with Firefox / Iceweasel etc.

Regards
/Jonas

--
Jonas Eckerman
Fruktträdet & Förbundet Sveriges Dövblinda
http://www.fsdb.org/
http://www.frukt.org/
http://whatever.frukt.org/

Ted Mittelstaedt

2010-04-21 20:25:45 UTC

The FreeBSD ports work by when the end user goes to the
ports directory and types "make" the ports maker downloads the code
to the FreeBSD server. This solution does not rely on the DCC author
putting the current DCC code into the FreeBSD ports tree since the
DCC author's site is hosting the DCC source nor does it require
the FreeBSD project to distribute a compiled binary. This also
allows the DCC author to exert control over the source since if he
decides he wants to stop distribution he simply stops offering the
source on his site, and the next FreeBSD user who attempts to install
DCC will get an error message when the ports maker on their system
cannot find the source.

It's a solution that gives all of the power over distribution to the
authors of these kinds of packages. So it's little wonder the DCC
author helped out. However, FreeBSD ports is only a great solution as
long as the author's distributing.

I have a number of pieces of software that I
depend on here that either have authors who have decided to stop
offering them or more commonly decided to abandon working on the
packages. I have therefore been put into the position of having to
keep private storage of their code and patches and manually compiling
it and modifying it for newer FreeBSD versions. While I have the
ability to do this many other FreeBSD users don't, and so when
the authors of those packages decide to pull up roots and move on,
those users lose the benefits of that software. And a few of
those authors have moved on because they withdrew the freely
available and free source of their packages and replaced them
with commercial packages that did the same thing.

Unlike FreeBSD Ports the Linux system which requires the packages to
have their source hosted on the Linux master repository, takes
control of distribution away from the author. If the author
decides to withdraw his package and replace it with a non-free
substitute, or if the author simply loses interest in his package,
the users aren't left out in the cold, they can still run the
older package if they want. That happened to Ghostscript
when Aladdin decided to pull it out from under the GPL and
put it under their own license. (an issue that has since
been solved)

The point is you can't say that just because the DCC author worked
with the FreeBSD community that he's just as willing to work with
the Debian community - the 2 are very different. FreeBSD for one
thing won't tolerate the GPL anywhere in their source tree, although
they will use GPL-licensed programs if necessary (such as gcc)

He is currently working on re-writting the DCC.pm for SA 3.3.x to make
it faster and more stable.
Or is it your debian folks just forgot to update it?
As was previously posted (by someone else) DCC is free for most
everyone, including ISP's who use it in their mail servers to protect
their own clients.
So, put your money where your mouth is. Why won't debian fix their
broken RPM? someone official from debian want to chime in?

Unless things have changed in Debian-land, anyone is free to join
and be a Debian developer. (anyone who writes C code, that is) I
thus have to ask if the DCC author was dissatisfied with the RPM why
didn't he get commit rights and fix it himself?

Frankly my view is this is a tempest in a teapot anyway. Who uses
Debian nowadays? Everyone I knew who used it switched to Ubuntu
a while ago.

Ted

Micah Anderson

2010-04-22 21:24:37 UTC

The DCC author would welcome Debian replacing the old, broken code
with something new.

That will only be accepted by Debian if the license were changed to be
DFSG compliant[0], at which point it would be gladly re-introduced into
Debian. I would even be happy to facilitate that process as a Debian
Developer.

Post by Michael Scheidell
Or is it your debian folks just forgot to update it?

My previous message detailed why it wasn't updated[1], a message that
you replied to, more than once. Debian did not 'just forget to update
it', rather it seems that you were the one who forgot something (the
reason why it was not updated).

In fact the whole thread here has continued on as a result of that very
reason why Debian did not update it. I'll cite it again for you[2]

"The Distributed Checksum Clearinghouse source carries a license that is
free to organizations that do not sell filtering devices or services
except to their own users and that participate in the global DCC
network."

This specifically violates DFSG #6.

Its also worth noting here that the original Debian maintainer expressed
frustration about the communication with upstream because, "he seemed to
blacklist several ip ranges, including master's main mail server and
murphy's [ed. note: these are Debian's mail servers] ip-range as well as
the ip-range i ussualy [sic] used for mailing. So neither mailing him
directly nor mailing to the mailing list was possible." [editor notes
mine]

Post by Michael Scheidell
As was previously posted (by someone else) DCC is free for most
everyone, including ISP's who use it in their mail servers to protect
their own clients.

There is free as in money, and then there is free as in freedom (libre),
these are different things.

Post by Michael Scheidell
So, put your money where your mouth is.

So the money is there, now what?

Post by Michael Scheidell
Why won't debian fix their broken RPM?

Probably because Debian doesn't use RPMs... sorry I couldn't resist. The
real reason is the one cited here, and in previous messages.

Post by Michael Scheidell
someone official from debian want to chime in?

Since I am a Debian Developer, I may count as 'official' here.

micah

0. http://www.debian.org/social_contract#guidelines
1. http://permalink.gmane.org/gmane.mail.spam.spamassassin.general/128332
2. http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=380542

Michael Scheidell

2010-04-22 21:32:52 UTC

Post by Micah Anderson
In fact the whole thread here has continued on as a result of that very
reason why Debian did not update it. I'll cite it again for you[2]
"The Distributed Checksum Clearinghouse source carries a license that is
free to organizations that do not sell filtering devices or services
except to their own users and that participate in the global DCC
network."

and, this is in their LICENSE or just the comments?

what about mysql. maybe debian can distribute it, but many users can't.
seems debian can distribute DCC, many users can't.

http://www.mysql.com/about/legal/

For OEMs, ISVs, VARs and Other Distributors of Commercial Applications:

OEMs, ISVs, VARs and other distributors that combine and distribute
commercially licensed software with MySQL software and do not wish to
distribute the source code for the commercially licensed software under
version 2 of the GNU General Public License (the "GPL") must enter into
a commercial license agreement with Sun.

seems your frustration with the author is the problem, not the license.
maybe at the time, (and depending on when that was) there were external
pressures on the author that complicated his ability to dialog.
--
Michael Scheidell, CTO
Phone: 561-999-5000, x 1259

Post by Micah Anderson
*| *SECNAP Network Security Corporation

Bob Proulx

2010-04-24 17:41:42 UTC

and, this is in their LICENSE or just the comments?

It is in their license. Read it yourself:

http://www.rhyolite.com/dcc/LICENSE

That is not a free as in freedom license. That is only a no cost
license if you meet their listed restrictions. But what if you don't
meet their listed restrictions? Then of course it isn't a no cost
license anymore.

Debian is free as in freedom software and you can freely use it for
any purpose without needing to meet a list of restrictions on each of
its tens of thousands of packages.

Post by Michael Scheidell
what about mysql. maybe debian can distribute it, but many users can't.
seems debian can distribute DCC, many users can't.
http://www.mysql.com/about/legal/
OEMs, ISVs, VARs and other distributors that combine and distribute
commercially licensed software with MySQL software and do not wish to
distribute the source code for the commercially licensed software under
version 2 of the GNU General Public License (the "GPL") must enter into
a commercial license agreement with Sun.

That seems very clear to me. Either you are able to distribute
everything under the license of the GPLv2 /OR/ you can't. If you
can't /then/ you need a commercial license. The authors are able to
dual license or multiply license their own software as they see fit.

Remember that you can't remove something (GPL) by adding something
(commercial license). It is an addition.

Since Debian distributes everything under a free license then they can
distribute the free parts of mysql under the terms of the GPLv2 as
stated.

Bob

Micah Anderson

2010-04-22 21:43:00 UTC

Post by Ted Mittelstaedt
Actually it's not even that. The notion that Debian spent effort
detecting and removing DCC source is rather farfetched.

Sorry, but you are pretty off here. Debian does this all the time. I'm
an official Debian Developer and I have personally been involved in
doing this a few times.

Post by Ted Mittelstaedt
Because Linux distros are so large, many freely available
commercially-licensed apps - such as device drivers - some of which
also do not carry "your allowed to distribute this" licenses, get
"sucked up" into the distributions.

Unless you can find an example, you are making a specious argument. Do
you know the process to get software into Debian?

Post by Ted Mittelstaedt
Some of this happens by users contributing them and not reading the
licensing closely enough, but quite a lot of it happens by commercial
companies deliberately inserting their stuff in the distros.

First, 'users' do not contribute applications to Debian, that isn't how
it works. Secondly, even if an official Debian Developer (who actually
is the only person permitted to contribute things to the Debian archive)
happens to do as you assert and not read the licensing, then the Debian
FTP-masters, whose role it is to specifically determine if the Debian
Developer did their due diligence in checking the license restrictions,
would reject that package.

I guess the fact that I had to explain this answers my previous
question, you do not understand how software gets into Debian. I would
advise you to educate yourself before making arguments that by their
very nature demonstrate your misunderstanding, it weakens your argument.

[snip]

Post by Ted Mittelstaedt
It's also generally understood that if a commercial app seller
doesen't like it they have the right to complain and get an immediate
cessation of inclusion of their apps in a distro. That is why I
suspect happened
here.

Sorry, but if a DFSG-licensed application is put in Debian, no
commercial app seller has any right to "complain and get an immediate
cessation of inclusion of their apps in a distro". It doesn't work that
way.

Your conclusions are amazing, but that does not make them any more
right.

micah

Ted Mittelstaedt

2010-04-22 21:49:12 UTC

Post by Ted Mittelstaedt
Actually it's not even that. The notion that Debian spent effort
detecting and removing DCC source is rather farfetched.

Sorry, but you are pretty off here. Debian does this all the time. I'm
an official Debian Developer and I have personally been involved in
doing this a few times.

Unless you can find an example,

Uh, DCC?

Post by Micah Anderson
you are making a specious argument. Do
you know the process to get software into Debian?

Obviously didn't work with DCC.