Subject: RE: [hackers-il] Idea: Worm with EULA

From: Chen Shapira <[email-masked]>
Date: Mon, 24 Sep 2001 16:07:28 +0200

>   Most users automatically click OK when they see an EULA 
> without reading a
> word. Interesting enough, many of these people will never 
> sign something
> they didn't read. However, with legislation that makes EULAs 
> binding, both
> have the same legal weight. In that sense, this could be an 
> interesting
> test.

There is a slight diffrence between EULA and a contract.
When you read your rent contract, you look for things you want to change,
and ask your future landlord to change them.
With EULA, one of the reasons we don't bother to read it, is that its the
only game in town.
If I need a certain program, I know that I'll have to agree to the EULA in
the end. So I just agree in the beginning.
BTW, some contracts I barely read, I never read the contract I signed when
openning a bank account, or when getting a credit card.
 
>   Rethinking it, we should actually write in the EULA what 
> the program does
> ("This program will send itself to all people from which you 
> have stored mail
> and then wipe your entire hard drive. By clicking 'I Accept', 
> you hereby waive
> all claims against the manufacturers of this program.")

You are getting more extreme. Last post you claimed that this worm won't
cause demage.

BTW, perhaps you should familiarize yourself with the concept of illegal
contracts.
Not every contract you sign is binding.
A person can't sell himself to slavery, and in many places the "no warranty"
clause is also non binding.

>   When did you see an open source product forcing you to 
> agree to an EULA? :)

They usually ask me to agree to a GPL or other license. 
GPL is no warranty too.

> Also, with open source you can check the program before agreeing to a
> disclaimer of all warranty or liablity.

Sure... Right...
The same person who can't be bothered to read 50 lines of EULA will now read
1000 lines of code?
Also, an open source program could be in a programming language you don't
know too well (emacs modules in lisp come to mind)

>   See my comment above. Most people don't think of EULAs as 
> binding contracts.

I agree, thats why they feel free to copy propietory programs around.
they just can't force themselves to take computers as a real serious thing.
But I doubt if the worm will make them change their mind, especially since
it may well be non-binding.

> > IANAL either, but it sounds interesting.
> 
> So let's go... we should just remember to cover our backs...

I'm a bit hesitant here.
I like the idea of seeing users agree to horrible things without even
knowing.
I dislike the idea of email worm, both in burden to the infrastructure and
in the breach of privacy involved when you read someones address book.

Sorry, but I doubt if I'll carry it out.
I still want to do some sort of study on the subject of "what makes users
click", but I'll guess I'll do it the usual way with a usability lab.

And on the subject:
There used to be a service provider in the states, they gave their users a
special email client to use.
During usability study it became apparent that users have trouble closing
the program.
Apparently, when clicking "exit", the program displayed a popup saying "are
you sure you want to exit?". Most people decided that they did something
wrong, and the program is warning them, so the clicked "no" and searched for
a diffrent way to close the damn thing.

Tricky thing, users.

---

From: Adi Stav <[email-masked]>
Date: Mon, 24 Sep 2001 18:23:38 +0200

On Mon, Sep 24, 2001 at 04:07:28PM +0200, Chen Shapira wrote:
[snip]
> They usually ask me to agree to a GPL or other license. 

The GPL is a copyright license and not a contract, and is therefore
"binding" regardless of whether you agree to it or not. The GPL says
as much inside it. Therefore, asking for users to click on the GPL
carries no legal weight, although it might well serve other purposes.

In spite of that, I am aware of Open Source licenses which do include
a contractual agreement. Additionally, there are rumors (from Bruce 
Perens) that requesting such a contractual agreement is being 
considered for GPL 3.0.

---

From: "Nadav Har'El" <[email-masked]>
Date: Mon, 24 Sep 2001 18:50:57 +0200

> "binding" regardless of whether you agree to it or not. The GPL says

I am not a lawyer, etc., etc.,

Are you sure there's such a term "copyright license"? As far as I see it,
these are two seperate things. "Copyright" says that nobody can copy your
creation. "License" is like a contract that the other side doesn't actually
sign, that gives the other side the right to copy your creation anyway,
under certain conditions. I don't see why this is any different from an
unsigned contract or EULA, and why you think the GPL isn't a EULA too.

The GPL being a "contract" simply means: you don't have to agree to these
terms, but if you don't you are left with all the rights you had before
(and no additional rights) - and you didn't have any rights to copy, because
this program is copyrighted!

-- 
Nadav Har'El                        |       Monday, Sep 24 2001, 8 Tishri 5762
[email-masked]             |-----------------------------------------
Phone: +972-53-245868, ICQ 13349191 |Computers are like air conditioners. Both
http://nadav.harel.org.il           |stop working if you open windows.

---

From: Adi Stav <[email-masked]>
Date: Mon, 24 Sep 2001 22:15:38 +0200

> this program is copyrighted!

IANAL too, but I understood things a little differently. Copyright
means no one can copy your creation without a license. One doesn't 
"agree" to a license, one either receives it or not, and if not, 
then he simply isn't allowed anything without it. A license can go 
all the way from "I'm not allowing anything" to "You can consider 
my works uncopyrighted for all practical purposes", passing through 
things like "You can distribute source code but not binaries" and 
every conceivable subset of actions or non-actions that the license 
can allow or disallow. And you don't have to agree to it, only to 
receive it.

But a LICENSE cannot say things like "if you distribute my software, 
you are not allowed to criticize it". You can either let someone 
distribute or not distribute your software, but you cannot allow or 
disallow criticism, because it was never in your power to disallow
criticism to start with. Similarly, you cannot demand and limit 
people's USE of your software, because copyright law doesn't give
you the right to limit use, only distribution. What you CAN do is to 
sign a CONTRACT, or an AGREEMENT, with some other party in which they 
agree to use your software only in certain ways, in return for a 
copyright license.

The problem here is that people aren't going to start scribbling 
their signatures every time they feel a desire to agree never to 
use Front Page 2000 for anti-Microsoft sites. Contract law allows 
certain things to be traded in contracts that you sign implicitly 
when you open the software's package or click a dialog box. But those
are still contracts. The difference is that they don't have the 
full power of hand-signed contracts -- for example, I don't think
you can agree to pay the copyright holder in advance unless you
sign it in a more explicit way. What UCITA tries to do is to broaden
the range of actions that shrinkwrap/clickwrap licenses are allowed
to govern, which could potentially make Chen's "the only game in town"
into a version of "The Running Man" game.

So: 

Copyright: the exclusive right to copy.

Copyright license: giving rights to copy to someone else too.

License Agreement: trading a copyright license for other things.

Shrinkwrap/Clickwrap License Agreement: a limited version of a license
agreement that doesn't require an actual signature.

---

From: Tzafrir Cohen <[email-masked]>
Date: Mon, 24 Sep 2001 23:00:21 +0200 (IST)

On Mon, 24 Sep 2001, Adi Stav wrote:

> IANAL too, but I understood things a little differently.

[ snip ]
> agreement that doesn't require an actual signature.

Here is what someone who _is_ a lawyer wrote about gpl (Basically the
same as what Adi detailed above):
http://linuxtoday.com/news_story.php3?ltsn=2001-09-18-013-20-OP-LL

-- 
Tzafrir Cohen
mailto:[email-masked]
http://www.technion.ac.il/~tzafrir

---

From: Gilad Ben-Yossef <[email-masked]>
Date: Wed, 26 Sep 2001 08:34:24 +0200

> carries no legal weight, although it might well serve other purposes.

IANL, but I think we got a little mix up here:

Copyright to a piece of work, such as software belongs to the person who
wrote the program or paied for the copyright (such as the employer of
the person who wrote the program).
No other person or legal entity has the right to make use (copy, use,
distribute) the copyrighted work (let's leave fair use behind for a
second).
This is true for ANY software, closed, open or free.

The EULA is a *contract* that you sign or agree to, which states that in
exchange for you complying to specific terms the copyright holder has
set forth (be it to give him money and not reverse engineer the program
or the terms in he GPL or what have you) you will get a premission from
the copyright holder to use the program (usually) or to extra stuff with
it (e.g. GPL and friends). This contract is called a license.

You don't have to agree to a license, jsut like you don't have to sign
any contract, but without doing so, you don't get the copyright holder
premission to do whatever it is the EULA says you can do if you agree. 

The same mechnism is at work whether this is the MS-Word EULA or the
GPL, only the terms of the contract are different. Simple, isn't it?

Gilad.