From: Randy Lawrence Date: 2004-07-16T09:23:36+09:00 Subject: Re: Problem using Ruby as script language, which limits its distribution speed Christian Kaiser wrote: > Phil, > > >>>Now I need to write a text filter in a commercial application. In the > > last > >>>one or two years I've become accustomized using Ruby and its advantages, > > but > >>>now I see that using Ruby in a commercial application is not failsafe > > legal, > >>>thus I can/may not use it. >> >>What do you mean by 'failsafe legal'? > > > That means that it passes our legal department, so that they can say we are > allowed to use Ruby for our purpose - embedding a ruby DLL into a small > application (actually I could use rubyw.exe, but to protect our script I > need to create something like rubyw.exe but which decrypts our script before > passing it to the ruby engine). > > It's just a "script in, source file in, processed file out"-type of > application. But either I use the DLL or I need to compile the lib - both > not clearly stated what I need to do. > > The lawyers fear that we need to pass all the files on to the user (which > would by itself not be an absolute no-no), but then we would need to look at > all files, make sure all of them can be copied legally, and so on; add all > the copyright information to our own terms of use. Lawyers are payed for > looking danger in every corner, but I need to accept their statement. > > Right now they said that it's not clear that we can use Ruby at all. > > >>>Is there an official statement on Ruby and commercial usage? I know > > LICENSE > >>>and it is neither bulletproof (the "exceptions" in the file list, see > > LEGAL, > >>>give our legal department heartaches) nor does it state clearly whether > > it's > >>>allowed to use the library (*.DLL in my Windows' case) alone - which in > > my > >>>case would be sufficient - I don't need to compile any C source code, I > > just > >>>want to be able to evaluate a .rb script. >> >>Depends on what you're using Ruby for in your application. The current >>regex engine is GPL, however Onigumura (sp?) the new regex engine (I >>believe it's included in the 1.9.0 source now) is LGPL and so has less >>restrictions. So you may just have to replace the current regex engine >>with Onigumura (aka the new regex engine ;-) > > > The old RegEx is already under LGPL, so then there would be no difference. I > assume Oniguruma is free. LGPL _should_ be no problem for us (it allows > linking to an executable or library that is under LGPL without restriction, > which we would do), but nobody can tell for sure. > > But you see what I mean, if you write "you may have to"... It is not stated > clearly what can be done. And in these days where a lawyer is behind the > next corner, waiting for something to do, this is just too dangerous. > Software-patent-issues that will grow more and more add to the threat, but > that's another story and unrelated to Ruby (I hope). > > >>>So again: Is there an official statement on Ruby and commercial usage > > which > >>>a legal department can accept? > > >>Yes (well it depends a lot on how you want to use Ruby in your >>application). > > > Again a "depends" :))) > > >>In fact at my previous job we used Ruby to script some installation >>issues on a CD. So we included Ruby on the CD as well as our scripts for >>doing the install checks. The user ends up running a Ruby script after >>the CD is inserted in their system (well, it's a lot more convoluted >>than that, but I don't want to go into all the details) We passed all of >>this by legal and it was approved. > > > So this is because you use the EXE, not the DLL, I assume. > > >>In your case it would seem that you want to use Ruby as a DLL - that's >>certainly different than the way we were using Ruby. However, I think if >>you were to replace the current regex engine with the new LGPL'ed regex >>engine you probably would have no legal difficulties with using Ruby as a >>DLL or shared library. > > > Yes, but you also seem to be unsure about these issues... "you _probably_ > would have no legal difficulties". That's what I want to show: it's really > hard as it is now, to be sure of the legal issues of commercial use. Which > as a single one-man-show developer would stop me from using it as I have no > lawyers. Some of them will ignore the problems, and some will use a > different script language - the latter bad for Ruby and its acceptance. > > I don't blame Matz - he mabe did not have an alternative to the old regex > (and other files mentioned in LEGAL), or he did not care, but this is an > issue that should be taken care of. > > Thank you, > > Christian > > A semi-secure way to distribute ruby scripts to customers/users would be highly desireable for commercial applications. After all, even compiled c/c++ apps can be reverse-engineered with enough time/effort. Are you planning to open-source the secure interpretation portion? You might find a smart volunteers to contribute effort. And having extra eyes on it would certainly make it more secure so your company would benefit too. Whether you choose symetric/public key encryption or simple obfuscation, I think there's strong demand for this (just look at commercial perl or java obfuscator products & pricing).