Shutting down our public encrypted DNS(mullvad.net) |
Shutting down our public encrypted DNS(mullvad.net) |
This seems like an overstatement: I have been running my own recursive DNS with Unbound for years and never thought it was a "highly specialized undertaking." It took perhaps a couple of hours to set up in the pre-AI age. I filter ads and trackers using an aggressive blacklist[0].
This dude has been doing it for 25 years, and actually this is a dns provider for domain names which I'm decently sure makes it more complicated than public dns.
They're allowed to say they don't want to pay for it anymore, I just think their logic is bad. Or maybe their lawyer said they're running risks just ignoring takedown and they didn't want to deal with it anymore.
I'm sure that the time, effort, money, and exposure that goes into responding and adhering to legal requests for a publicly offered service is something Mullvad wasn't expecting and would rather not be doing considering it's not their core focus.
Can you expand on this? Isn't all DNS for domain names?
Hey dang can I get my rate limit removed yet?
Brilliant.
[1] https://quad9.net/news/blog/italian-blocking-demands-followi...
Seriously, what the fuck? So you're supposed to block VPNs as well? What's next, Tor exit nodes? New VPN and Tor nodes as they pop up? I really don't like where this is going.
>Since Quad9 already performs DNSSEC validation, DNSSEC being enabled in the forwarder will cause a duplication of the DNSSEC process, significantly reducing performance and potentially causing false BOGUS responses.
This sounds dodgy. Surely that means Quad9 can poison my DNS?
Haven't had time to study the bug and really understand the whole issue myself. Just left it there with the takeaway that local validation is currently not for non-experts.
(Sorry not at my computer. Details rather vague from memory.)
What's the specific threat you're envisioning? If it involves Quad9 themselves being malicious, what would DNSSEC on the forwarding prevent?
This page explains how all of this works in detail: https://quad9.net/news/blog/quad9-enables-dnssec-on-all-serv...
Maybe it’s time to try nym.com?
Fiber ONT -> Proxmox x86 -> OpenWRT -> Adguard Home -> unbound -> Quad9.
Browser: Firefox + ublock origin & privacy badger & strict privacy setting & Https-only.
My internet is rock solid and super fast, extra low latencies. OpenWRT shapes my traffic to 90% of line speeds, so zero bufferbloat on my end. All my devices connect to this setup. The proxmox box is just an old dual core mini-pc with 8gb ram and 2x 1gbps NIC's and a wifi 6 module for 2.3gbps wireless (only 5Ghz, no 2.4Ghz). I want to replace this box with a new one to get 2.5gb ethernet & better power efficiency as my box is a 51W cpu, but total powerdraw is about 20w without causing wifi to drop. Aggressive power saving can make wifi unstable.
I hope at least they'll keep these options in their tunnel configuration but if not there's not much sense in keeping their service....
> Mullvad Browser uses them [ the DoH servers ] by default when you're not on Mullvad VPN, preventing your ISP from seeing the domains you visit.
This is a half-truth until Encrypted Client Hello (ECH) is in-use for most of your traffic. Sure, you won't have clear-text DNS floating out there in the series of tubes. However, without ECH the hostname you're connecting to is exposed in the SNI field during TLS handshakes.
I imagine most sites we are browsing will eventually be able to leverage ECH, so this should become less of an issue over time, but in the event you frequent any self-hosted operations (e.g. no Cloudflare or similar), encrypted client hello could still reveal identifying information since it requires still exposing an "outer SNI" that a valid certificate needs to be presented for. You only get to easily hide in with the masses when you use a big infrastructure provider as a consequence, since the common outer SNI of cloudflare-ech.com doesn't really reveal anything different than an IP <-> ASN database would. But if the outer SNI is "dunder-cat-enterprises.com", then all I've protected you from is your ISP snooping on the subdomain or pinpointing exactly which one of my domains you might be talking to.
VPN providers at the tier of Mullvad should be precise about this stuff -- I think it's more than just a nitpick, considering the audience. oh god did I just use an emdash.
Note that you need some flavor of secure DNS to enforce ECH. The protocol is designed to be downgradable.
Unbound can also be used to block malware and advertising domains using shared public lists, or you can build your own list. Your resolver’s DNS queries could be piped through Mullvad or Tor if you want additional privacy.
While reproing the issue I noted the average recursor round trip time from my OVH server hosted in Oregon to the default upstream DNS - Quad9 - was around 70ms. When I changed it to Hurricane Electric the roundtrip dropped to a steady 20ms. Later I changed it again to Cloudflare and the roundtrip was a consistent 2 to 3ms.
Sad to see this going away, but I assume this is so Mullvad can focus on their primary services.
First: We welcome the Mullvad users who will be shifted onto our systems, and we appreciate that Mullvad contacted us instead of doing this unilaterally. Since we have no signup process, they could have just moved users across but we very much appreciate their cooperation and communication, both with us and with the users of the service - this is exactly how an ideal transfer should go, at least from our perspective.
I'll try to make some short summaries of some of the points here, and a reply on each.
"You should just run your own DNS server - it's easy." - Yes, we agree that for a small company or home running your own recursive resolver is a reasonable solution. You probably won't get the threat mitigation depth of service that Quad9 offers, but you may not want that. Privacy also suffers a bit, since it's still the same IP address (your home "public" address) sending queries to authoritative servers, probably unencrypted. A good middle compromise is to run PiHole or AdGuard software, and forward your queries to Quad9 via an encrypted connection. (see below) This mixes your queries in with a large number of other users, and gets the potential improvements of having a much larger active cache nearby which will have "hot" answers. Running a home resolver for yourself or even a few dozen (or even a few hundred) people is not difficult. But with all services, things change with scale. As the query volume and number of locations grow, you soon find yourself hitting all possible exception cases, instantly. Many millions of requests a second requires a lot of time, expertise, and money to ensure nearly 100% uptime. We are admittedly quite a small group - less than 10 full time - but even that is under-staffed for supporting more than 100 million daily users. We do quite a bit with a very small resource set, and I doubt it could be done less expensively with the same robustness for the same scale. Again, we appreciate Mullvad's sponsorship to help keep this expanding at our normal weekly growth rate of around 2%.
"I want ad blocking, and Quad9 doesn't do that" - Correct, Quad9 does not do ad blocking at this time. There are good solutions like PiHole or AdGuard extensions that provide this functionality, and getting local control and logging of your DNS queries is probably useful for power users. There are also commercial platforms that provide this capability, and they may provide significantly more "knobs" for what you want to block. Quad9 is a non-profit - we're not out to corner the market, and as long as privacy and security is increased for the end user, we're all for commercial solutions!
"Quad9 blocks domains in Germany" - Currently there are no mandatory blocks that Quad9 is integrating or enforcing on our DNS platform, from any external party. We did briefly block some domains as a result of legal actions against us in Germany. The good news is that we won that case in Germany, after two years and three appeals and an enormous amount of time and money (which despite Germany's "loser pays" rule, is not even close to expenditures.) https://quad9.net/news/blog/quad9-turns-the-sony-case-around... The bad news is that the identical thing is happening now in France where we have a number of legal cases open against Quad9, and we do not see an end to this any time soon as long as there is an open question in the EU about what a content-neutral intermediary is and is not required to do.
"Mullvad exiting creates more centralization, and that is bad." On the fact that centralization is bad, we agree. DNS resolver centralization is not a great thing, and it seems to be trending in the wrong direction. It's not just large public resolvers - consolidation in the ISP industry is causing more and more of the world's internet-using population to utilize a smaller number of recursive servers. Those servers are operated (mostly) by law-abiding companies, and so there is a strong interest by various parties interested in control of content to "put a hand on the available throat" even though it's the wrong throat to choke. We're busy with some ideas of how to solve this, both from a legal defense position as well as a technology position - stay tuned in the coming months. In the meantime, you can contribute a few euros/francs/dollars to us and we'll have more funds to pay for legal defense in France and hopefully up to the EU courts. https://quad9.net/donate/
"Government agencies can tap data" - Quad9 is based in Switzerland. Despite what may be common knowledge from movies, there is a very formal and rigorous process for governments (Swiss or non-Swiss) to demand data. It is (ultimately) transparent, and managed in a way that is quite well structured - this is, after all, what the Swiss have been doing with financial data for many years. More importantly: Quad9 stores no user data about queries. There isn't anything to demand - the box of data is quite empty. Because of this technological decision and our wide announcement of it (https://quad9.net/about/transparency-report/) we have never received a request for data. As for technological methods: Quad9 operates in 200+ widely-separated locations, with no backbone or central data transport network - it is intentionally 'islanded'. It would be a significant challenge to intercept data at all those locations, though we're certain that there are many queries that are observed due to their presence on various ISP or cable networks which are under surveillance. We support all major DNS encryption methods today (even the two that run on QUIC - HTTP/3 and DOQ) and we encourage users to use one of those for their communications to us. We are also one of the few major resolvers experimenting with ADOx, which encrypts messages between the recursive resolver and authoritative server. (https://dnsprivacy.org/adox_status_and_deployment/)
IME, it was much faster than Quad9 for this purpose
First Mullvad shuts down its Google search proxy
Now its DoH service
What's next
I say this respectfully, but Mullvad is perhaps “dumbing down” their VPN service in an effort to simplify their operations and cater to a wider and more general audience.
For sailing the high seas, or for harboring? I, for one, am glad to not have Mullvad's IP ranges blacklisted everywhere.
1. Not every service still supports 1.1, RFC recommends H2
Discontinued
Are there any alternatives?
Quad9 also has worse latency but I could live with it, I just can't live with web pages failing to load several times per day(especially hacker News that has their DNS TTL set to 1 second)
It doesn't happen with my ISP's servers nor with CloudFlare or google or even good ol' L3.
Additionally the default of blocking 'malware' doesn't jive with uncensored internet - that should be an opt in and not a default on their flagship address if they want to be taken seriously as unfiltered provider.
If the encrypted endpoint can go down for extended periods and they curate list of 'malware' they are not something that should be considered a gateway to uncensored and open internet.
I'm not trying to start an unhealthy discussion about this topic, genuinely curious about your opinion on the matter.
It's great that they didn't try to cancel the guy or get seduced into driving a wedge into their team. It is great they chose their principle over pleasing the crowd in such a transparent way.
I have been a customer for many years. I once even used the cash payment option out of curiosity.
Here is their statement:
https://mullvad.net/en/blog/donation-controversy
They even linked his (Swedish language) private blog on which he wrote on the issue:
Those parties exists for a reason, a response to certain pressures. Nothing happens in isolation. If you zoom out a bit and if you can for a second try to empathize with both sides, you will often find that both sides of an issue is correct, reasonable & rational from their own perspectives. It is often more an emotional response than one of pure survival.
The more you force things on people or suppress them, the more they will resist & push back. The rise of the far-right is not random or just pure evil manifesting out of thin air. It is like a acute inflammatory/immune system response. Obviously it can be exploited by bad actors to further inflame/divide & accelerate certain agendas. Often times extremism takes hold when certain justices are denied (which is in fact evil).
Life is best if you assume the guy on the other side (90% of a group) is just a bro trying to survive & have no real bad intent towards you, they don't know you or have been in your shoes, and the other way around too. Thus it is very important to become non-reactive, become observant who is trying to stoke the flames, who benefits from the chaos and so on.
DNS is harder to do that way because it's hard to have limits on DNS. Perhaps DNS could be adapted with QUIC, to allow fast, encrypted DNS that's easier to rate-limit, and then it'd be easier for average people to run public mirrors with limits.
This is probably service you can host locally with the lowest maintenance and hardware requirements so it isn't even a hassle to do it yourself.
Use an online service that's new enough and small enough and it might not be compromised, but the moment it gets popular men with guns and national security letters with gag orders will show up to install hardware on their prem, take over entire offices, or just demand reports.
VPNs and secure DNS services aren't there to keep your data from the NSA, ICE, or even the police. They are useful for keeping your ISP from selling your browsing history to anyone willing to pay them (https://www.mitnicksecurity.com/in-the-news/republicans-just...). It'll help keep a little of what you do online away from data brokers, keep your ISP from sending you DMCA notices, and not much else.
However, it's not at all the reality of a vast swath of other countries (or, at least, not yet; see Chat Control v2). The US is particularly foul (and effective) when it comes to this practice, but anything outside of US jurisdiction that doesn't have an office in the US can't be touched by laws like these, and the laws of most other countries tend to be significantly less invasive than American ones when it comes to data interception and the practices surrounding it.
they arent gods. some people actually have moral standards and dont just do whatever a foreign agency wants them to do
Due to Lugano Convention [0] / Budapest Convention [1] / Hague Convention etc, I don't see how Switzerland is any more insulated than, say, Norway is (both these countries are part of EFTA & signatories to various UN/EU/EFTA treaties). Per this article [2], Switzerland ranks below Ireland, Portugal, Denmark, France in Data privacy laws (in fact, it ranks the same as the UK).
If I am being honest, at this point, "based in Switzerland" (or Cyprus or Sweden or Gibraltar) comes across as marketing gimmick VPN companies are notorious for.
[0] EU civil & commercial law enforcement in Switzerland: https://www.legal500.com/guides/chapter/switzerland-enforcem...
[1] Mutual Legal Assistance Treaty (MLAT) is bypassed: https://rm.coe.int/16802e726c
[2] https://www.comparitech.com/blog/vpn-privacy/surveillance-st...
It seems all too similar to the degradation of peer-to-peer networks where nodes are replaced by few supernodes. You mentioned a couple reasons yourself: consolidation and legal pressure. Add to this the technical qualification aspect and time investment (Mullvad's position), and the financial cost of sustaining such a non-profit project. Suddenly there are very few people or even organizations worldwide, who can bear the burden.
Thank you for existing and your tireless work.
https://adguard-dns.io/kb/general/dns-providers/ have a list of options that some of them have ad blocker
Trivial to self-host, and gives you full control of blocking.
Sometimes you need to unblock things to ensure something works properly, so having it be local is better in my opinion.
1.1.1.2
1.0.0.2
2606:4700:4700::1112
2606:4700:4700::1002[0]: https://www.flamman.se/techprofil-ger-miljoner-till-orebropa...
If that is what they say before they get power, you need only the basic lessons of history to understand what they might do after they get power.
This was probably the most ignorant thing I've read today. You're knowledge of political history must not extend very far.
is there a single party in Europe campaigning on the promise of more immigration, I wonder? if so, how do they fare? :)
> That's something people should run themselves. I run Adguard Home on my router.
But you'll also get a bunch more benefits from OpenWRT, to make it worth your while.
- I was able to buy a router for <$100 that was WiFi 7 capable (W1700K[0]) and had better hardware than most consumer routers. You can find plenty of cheaper routers that are flashable and more capable.
- Adguard Home
- Split tunneling/VLANs: Since we're talking Mullvad, you can put devices behind Mullvad on a VLAN. So activate Mullvad by changing SSIDs.
- Trivial to put IOT devices on a VLAN (can make one directional too so you can access from your main network but they can't reach back. I throttle everything IOT)
- Tailscale
- QoS (Control the speed and prioritization of different connections)
- It's a fucking computer, you can even run shell scripts
If you're on an iPhone, uBlock is now supported: https://apps.apple.com/us/app/ublock-origin-lite/id674534269...
There's also Orion browser, but I found it to be a bit more glitchy, especially around sites like YouTube (fuck the app, I'm not watching videos there): https://orionbrowser.com/
I could also use a VPN to keep my phone always on my home network and thus behind my own ad blocking DNS but Mullvad's adblocking DNS was really nice and convenient.
Setting up a local resolver, such as a Pi-Hole or Unbound on a firewall can serve unencrypted responses to your devices. Those resolvers in turn can use DoT/DoH with their upstream resolvers to encrypt the requests that go through untrusted networks on the Internet.
This is the best of both worlds, the simplicity of unencrypted DNS while encrypting traffic where it matters.
I've always been of two minds on this. On one hand, that concern is beyond any reasonable level of security/performance/reliability tradeoff for most any user. At the same time, it is a bit of a shame DNS doesn't have a more scalable & performant approach to security which can just always be done without having to consider it a tradeoff, however minor in practice.
1. The forwarder gets a response claiming the record is supposed to be DNNSEC signed from the parent (recursively traversing from the root). The forwarder checks the signature of this claim. If the signature is valid, the forwarder continues on to validate the signature of the record and checks its validity to know if the info was secure. If the signature is invalid, the forwarder knows any information any information is not able to be validated as secure
- Somewhere during the recursive checks through the root, the forwarder gets an unsigned (no DNSSEC) or invalidly signed (e.g. your stripped response) response. The forwarder knows any information is not able to be validated as secure.
- A claim for lack of configuration or support of DNSSEC records comes back. The forwarder knows any information is not able to be validated as secure.
So you always know whether or not the information was secure, it's just if it was insecure you don't know if it's because it was just never secured or if someone tried to tamper with it. And that should make sense, an insecure message is by definition one which you can't tell if it has been tampered with.
To protect yourself from an upstream resolver using DNSSEC, you need to be doing something akin to a full recursive lookup yourself. This is a flaw in the DNSSEC design and a reason why DoH took off instead.
What? I don't see how you can call that a flaw in DNSSEC when DoH is no better in this regard; it doesn't even attempt to protect against a malicious recursive resolver. The only way to do that is to validate DNSSEC on the client.
Big tech services are less private than you think but almost every provider who cares about privacy is safer than you expect. Most of the people who work there are committed to their mission, and if they ever get a gag order someone will leak it in no time because they know exactly how to do it without exposing their identity.
Lesson to learn: Let's Encrypt does not protect against MitM by a state-level actor, unless you take precautions. *let's assume network admins won't MitM your server for personal vengeance reasons
When it’s a hostile environment entirely, they hack and do secret operations and bribe.
I'm on your side but telling people to buy a new phone doesn't solve their problem. Short of that uBlock and/or Orion are their best options
Look, I still run AdGuard on my router, but it's not the same thing
For example, DNS blocking isn't going to block YouTube ads if you're using the app since they don't need to respect your DNS, but it will if you're in browser because they can't control that.
For apps I always use revanced.
Youtube ads do not get blocked by DNS adblock because Youtube ads are served from the same domains as the content and thus DNS blocking would be counterproductive. I don't think it has anything to do with respecting DNS.
I don't have the Youtube app installed to test but the Internet suggests that at least in 2023 it was very possible to block the Youtube android app (content and all) via DNS, which hints it does not bypass system DNS. [1]
[1] https://superuser.com/questions/713289/blocking-youtube-andr...
Edit: I'm with Quad9 (CTO)
Maybe your lawyer fucked up? Did you immediately appeal the fine or request a stay pending the main action?
Appeal court ruled on the substantive case. My understanding is that in Germany it has no procedural jurisdiction to order the state treasury to refund an enforcement fine. You need restitution claim that makes the thing yet another hoop.
And thanks for the great DNS service, I'm using it everywhere!
The appellate court ruled that independent recursive DNS resolvers are too far removed from the actual infringement to be held liable.
It'd be great for this to be the first major relinquishment of nation-state power to happen without violence, without backroom deals, without wedge politics and flag waving.
Just... let it go.
It's beyond obvious that copyright is not going to exist in 1000 years. Every creature on earth - especially the internet - survives by copying information. It's the most basic life force in the universe.
Copyright is serving exactly nobody today. It's time. Are there elder stateswo/men in the room who can see the writing on the wall and act with grace?
Anybody can change their DNS and for an ISP to perform a man in the middle on all dns they would need to inspect every packet. Impossible
That kind of thing isn't unheard of for police agencies with moral and oversight issues, though. Orgs start seeking for bigger reasons. A simple copyright issue creatively expounded into an imaginary global drug bombing cyber trafficking crime ring takedown creates a massive internal win. So they do that.
Trivial to do nowadays: https://focsec.com/
>I really don't like where this is going.
German courts think the internet revolves around German laws. There are some really insane cases, sometimes they will consider a website to fall under German jurisdiction simply for having a German-language version (somehow ignoring that Austria and Switzerland exist, ignoring German-speaking minorities in other countries, ignoring that a fully automated translation in 100+ languages is now possible at the click of a button).
Average of (current maximalist copyright; ending copyright) is what you called middle ground.
Average of a sensible position like (current maximalist copyright; ending copyright divided by 2) still does not yield a sensible world where culture and art - or even human interactions - can thrive.
The trenches between the different factions are far too deep for any middle ground to have any chance.
Calling a solidly democratic nation "fascist" is a rhetorical reversal straight out of the authoritarian playbook.
According to what? Some think tank’s “democracy index”, carefully constructed to preserve the illusion that Western countries are free and democratic? That’s begging the question.
He used violence and backroom dealing to get from that majority to become Führer, but without a doubt Hitler did get his foot into the door democratically.
Except for nearly everyone who writes anything (including software) or other artistic pursuits to make a living. This includes a majority of people here on HN.
Not to mention that everyone using coding agents probably aren't even protected by copyright in the first place, at least in the US, since the courts are taking a pretty hard line on human authorship being required...
Despite the SaaS model under which many of us build, there is still a tremendous amount of packaged and distributed software that people use every day: your phone and its OS and apps, most computer OSes, databases, medical records, transportation, communications—the list goes on—that many of us work on to put food on the table.
Let's say you write some software for your employer and they sell the product to several customers with a contract not to distribute it. However, the product appears on some pirate website anyway, and you can't identify who allowed the product to be leaked. Once it's there, your contracts are worthless as nobody who downloads it from the pirate site will be bound by your contract. You need copyright laws to prevent subsequent distribution.
Without copyright laws, you'd then end up in the situation where people who paid for the software then are bound by the contract and would have to keep paying, and those who just downloaded it from a pirate site would be completely fine legally and could use the software with impunity. That would create a disincentive for anybody agreeing to buy the software and entering into a contract in the first place, essentially killing the industry.
You might not see a problem with that if you believe in Open Source, but most licences require copyright laws to exist to protect the software freedoms so that people don't just take the software and close source it.
Modern IP law inhibits productivity more than it helps, imo. LLMs have fundamentally changed our line of work, and they have done so by completely ignoring the existing legal framework for IP. We should not defend the current implementation just because some people might suffer reduced earning potential.
I'm not just shooting from the hip here.
You wrote "copyright is serving exactly nobody today." If that's not what you meant, choose your words more carefully next time. This is a forum of writing, and, much like songwriting, the right words and nuance matter.
Are you sure about that?
So just to be clear;
You're advocating for the end of software licensing? Ie the removal of GPL or Open Source licenses? A landscape where any source code (or binary) can be snapped up by say Amazon or Microsoft and run via a paid subscription?
You're advocating for a business model which removes your access to local code and only allows access via a terminal or browser?
Because removal of copyright doesn't mean corporations go away. Rather it incentivizes business models that protect their products in other ways.
In the 80's and 90's, pre-internet, binary programs were distributed on media. An arms race of copiers and copy protection ensued. The copiers won, and since copyright enforcement has always been weak, business changed to favoring remote access (with subscription) over running locally via purchase.
At the same time Open Source and Free Software have thrived. Copyright protects that software being used outside the terms of the license. Indeed there's even outrage when it's used within the terms of the license (by AWS etc.)
Of course OSS still thrives under a copyrightless environment. (Free Software less so). But equally it means AI can simply be trained on it (probably no great loss since it's likely most of OSS will be AI generated anyway.)
Business however will adapt. And the easiest way to prevent coping now is simply remote execution. With a suitable Terms Of Use declaration.
Outside of software it would destroy music, movies, books etc. Basically it becomes a race to the bottom in terms of production costs (think user-generated You-Tube as the high-water mark.) But I assume you meant in the context of software.
Yes, I agree, that in much less than 1000 years copyright is dead. Because by then so much is in the public domain it doesn't matter anyway. Also because by then the last human programmer is long dead. AI will write anything you want, only you won't even ask because computer interfaces and abilities will be long past where we are now. You would have no need to create software any more than you need to build a plane or car today.
And those industries have taken less than 150 years to invent, explode, consolidate and commoditize. Indeed most of the complexity disappears when we go EV.
In 1000 years copyright is gone. But today it serves a lot of people.
Intellectual property serves corporate interests and the idea of "nations" you are forced to have in your head are the exclusive servants the interests of capital. Ironically, tragically, that's what's holding us back from dismantling it in the first place, even a critic of it can't articulate it properly.
Sorry that will be undecipherable for HN. Let me try again: The defense you get in this pigstall is the individual that copyright is protecting. You just hate the small businesses and individual artists. Instead of the trillion dollar industry holding the copyrights and the practice of exploiting copyright on works by authors who died decades ago. The commodification of copyright of something produced by the lowest bidder, crappiest AI and cheapest third world labor you can get your literal bloody hands on. Or even a vaccine against the literal plague or cure for cancer protected by intellectual property.
To make something immaterial with no cost to reproduce, a commodity, to trade and invest and speculate in is the part to argue if you want to dismantle it, identify the rotten bits of the system even peasants can smell. If you are a billionaire or even trillionaire then just argue like everybody on HN always does, because it's identical.
Almost my entire career was spent on such custom software. The rest was internal software. And even that one I was doing as a contractor, so in a way we could argue it was custom software even there.
I am not aware of any open-source license which tries to approximate the "there is no copyright" situation:
- Such a license would not compulse you to publish the source code of any modification you make for it.
- Such a license would allow you to distribute compiled programs only.
- On the other hand, such a license must not restrict you to de-compile, modify or re-destribute any binaries built from the source code.
- But any such derivate of such a binary or source code would have to stay under the same license (this is a different kind of virality than "normal" viral licenses).
If you look at outcomes it has completely failed while making big corps very rich in the process
If you want permissive rules then corporations will just resell your IP (like we see with SaaS). And if you want tighter rules then you just create a higher barrier for entry that benefits corporations rather than independent entities.
Either way, it’s easier to operate when you already have a leading position.
Oh, and also put a hard cap on individual wealth while we're at it. No one, no matter how hard working, deserves a billion dollars. And no one should be trusted with that much power, it's too goddamn dangerous.
(The caps should be indexed to stuff like median income or wealth. Wanna get richer? There's a way: help everyone get richer. That way we're actually in this together.)
And outside open source there has been a staggering amount of creative work at all quality levels done for commercial purposes under the protection of copyright. Is there a convincing argument that the last century of software and music and books and etc would have been just as staggering without copyright?
I would love to hear such an argument. In my youth I thought copyright was blatantly stupid and should be abolished. I still sorta think that but I don't have a convincing argument in the face of the absolutely massive amount of good work that has been produced under it.
> I would love to hear such an argument.
Fortunately, one of the many tentacles of the octopus most obviously at the forefront of the zeitgeist of the freedom that arises from a culture of free information - The Grateful Dead - had the outcome of producing - in the form of gripping autobiography - an extremely compelling, and seemingly utterly true and beautiful and good, instrument to fulfill your request:
https://www.goodreads.com/book/show/36750087-mother-american...
If you don't want to read a whole book and just want a stump speech which kicks ass in the department of argument you're requesting, it's here:
Yes, some people and companies benefit disproportionately, but those tend to be the ones who finance the process and bear the risk of loss due to failures and flops.