LGPL and tivoization #10
Description
The current "Why LGPL?" text states:
LGPL will improve final user experience, security and privacy, by hindering device lock-down, favoring up-to-date, and field-upgradable code.
Unless we go for LGPL 3 (currently we use 2.1) that is not the case. (Frankly I'm not even sure it's the case with LGPL 3; it is with GPL 3).
GPL 3 added provisions for "Installation Information" to mitigate "tivoization", a term coined when TiVo brought Linux devices to the market that complied with the GPL by giving the relevant sources, but had their bootloader locked so that you could use the software on own devices (have fun building an unlocked TiVo from scratch -- but you could still port it), but never upgrade your own device.
LGPL 2.1 has no such provisions, and thus we don't get the effect from the license. (In a sense we do still get the effect that RIOT devices tend to better upgradable, but that's more because vendors don't know the license well enough and thus just go for other OSes, and not because LGPL enforces this).
(It may also be worth noting that the field of firmware lockdown has become more diverse. Back in the TiVo days, if you could sign your firmware you'd have been good to go. Nowadays, there may be multiple firmware upgrade ways, some destructive to keys on the device. On some that's clearly legitimate -- if you could upgrade your USB 2FA token and keep the keys on it, that'd be terrible security. With others, that renders the device practically unusable -- think of an Android system where you can unlock the bootloader and then all its DRM (anti-, but that's not the point here) features are gone. If that device's purpose was to stream encrypted video from the network and show it on TV, yes you have upgraded the firmware, but unlike the aforementioned TiVo it doesn't serve its purpose any more.)
So what to do here ... if this is just a localized misunderstanding, let's find better text. If not and there is a larger disagreement on what LGPL entails, this may warrant wider discussion through the mailing lists or other venues.