On Thu, 2018-08-16 at 08:16 -0700, James Bottomley wrote: > So your lawyers tell you if you sign a third party module for your > kernel then you could get blamed for the damage it causes? So this > whole escapade is about Red Hat trying to evade legal responsibility > for allowing customers to load third party modules. > > Firstly, your lawyers are wrong: Microsoft took a lot of legal advice > before they agreed to become the third party signing authority for > UEFI. They definitely believe they can't be sued if they sign > something that later breaches UEFI security. However, I realise > trying to overcome overly cautious legal advice is a no win > situation, so lets move on.
Let me give you some advice from an old hand on this: You definitely can't overcome a lawyer with a legal argument (well, unless you're really good, pig headed and come spoiling for a fight), but you definitely can with a business case. Once you present a business case for doing whatever it is the lawyer's have said no to, the next instruction a good executive will issue is "quantify the legal risk so we can balance it against the business benefit". That's where a "no" based on over caution usually gets overruled because the risks look minor when exposed to scrutiny. To generate that business case, why not merge Mehmet's patches? If other distributions start using them successfully, then you'll have both direct and indirect business pressures for Red Hat to do the same and it will force the re-evaluation you need. If no-one uses them there'll be no additional pressure and you'll be no worse off. James
