On Jun 18, 2007, david@xxxxxxx wrote:
On Mon, 18 Jun 2007, Alexandre Oliva wrote:On Jun 18, 2007, david@xxxxxxx wrote:
they want to prevent anyone from modifying the credit card machine to
store copies of all the card info locally.
I see. Thanks for enlightening me.
you don't really answer this issue. since these boxes are required to
be sealed and physically anti-tamper, changing the ROM is not
acceptable.
Given the ROM exception in GPLv3, I guess you could seal and
anti-tamper it as much as you want, and leave the ROM at such a place
in which it's easily replaceable but with signature checking and all
such that the user doesn't install ROM that is not authorized by you.
'sealed, but easy to replace ROM containing the programming' is a
contridiction.
if a local person can easily replace the programming it doesn't meet
the PCI requirements and therefor you just cannot use GPLv3 code for
this sort of application.
How can someone easily replace the programming if there's signature
checking and all?
The sealing of the ROMmed software is accomplished by other means, but
it's there. I shall mention that I'm not endorsing or recommending
this practice, it might very well be copyright infringement even under
GPLv1 and v2.