From: Bill Stewart <stewarts@ix.netcom.com>
Date: Mon, 17 Nov 1997 10:39:59 +0800
To: cypherpunks@toad.com
Subject: Re: PGPsdk is now free for non-commercial use
Message-ID: <3.0.3.32.19971116182648.00706d44@popd.ix.netcom.com>
MIME-Version: 1.0
Content-Type: text/plain



[I'm also posting this to coderpunks, but cypherpunks is probably 
a better place for discussions.]

At 10:13 PM 11/15/1997 -0800, Bill Frantz wrote:
>At 1:06 AM -0800 11/15/97, phelix@vallnet.com wrote:
>>Well, PGP has come to it's senses and is allowing non-commercial 
>>developers to use the sdk for free.  I didn't notice anything too
>>ominous in the license agreement, and they promise a new 
>>licensing/prices for shareware and small commercial developers.
>>
>>Perhaps nobody is buying the sdk at it's current highly 
>>inflated licensing price.
>
>Much more likely is that more than a few cypherpunks discussed 
>the issue with PRZ at the last SF Bay Area Physical meeting, 
>and that discussion is bearing fruit.

I'm pleased to see PGP Inc. permitting development of freeware,
but at leased from a first reading of the license, 
it's a _really_ restrictive definition of "freeware" - 
not only does the software have to be free, but it can only be used 
in extremely restrictively non-commercial activities.
It's far more restrictive than RSAREF (though more precisely defined.)
Here's an excerpt from the web page at
	http://www.pgp.com/sdk/sdklicencefree.html
	For purposes hereof, the term "non-commercial" shall mean that
	the application 
	(a) has been distributed or otherwise made available at no charge 
	(direct or indirect) and 
	(b) is not used for any commercial purpose, which includes, 
	but is not limited to, any activity engaged for the purpose 
	of generating revenues (directly or indirectly). 
	For example, a commercial purpose includes the use of the 
	application within a commercial business or facility or 
	the use of the product to provide a service, or in support 
	of service, for which you charge. 
	Commercial purpose also includes use by any government agency
	or organization. 
	Examples of non-commercial purposes include use 
	at home for personal correspondence, 
	use by students for academic activities, 
	or use by human rights organizations. 

First of all, it sounds like it can only be used by students at
non-government-run universities, but not at Berkeley, and if
Random MIT Student develops PGPwidget using the toolkit,
students at U.C.Berkeley can't use it for academic use either,
except perhaps on their PCs at home (if they live off-campus.)
(Do any of the UK universities count as non-government-run?)

But "within a commercial business or facility" is far more 
restrictive.  
I use a laptop for my home and work email, and carry it around.
It sounds like I can't use PGPwidget or PGPsdk for encrypting 
personal email at lunchtime when my laptop is at the office,
and perhaps not from a hotel (at least if I'm there on business)?
I probably can't start PGPwidget at home and leave it running
when I carry the laptop to work.  I probably can't use PGPwidget
when I'm reading my work email at home, though perhaps it's ok
to use it on personal mail that someone sent to my work MSExchange,
assuming it's not a widget that competes with a PGP product.

This is frustrating - today, I can use PGP 2.6.2, and maybe 5.0,
at work, though I can't sell it without a license, and it's
not very clear whether I can run a commercial service without
a license (I probably need a license from RSA, but not PGP,
and non-RSA keys probably don't require that.)  And I can certainly
write programs that use PGP command-line interfaces to 
encrypt things without any restrictions on my code.
				Thanks! 
					Bill
Bill Stewart, stewarts@ix.netcom.com
Regular Key PGP Fingerprint D454 E202 CBC8 40BF  3C85 B884 0ABE 4639