GPLv3 is the fix, but Torvalds refuses to apply it to linux... root of the problem imho. When I can have a gplv2 linux on my samsung TV that gets rooted by the CIA but I can't root it without bricking it, you know it's time to switch to gplv3.
This is not true, not everything in the kernel is GPLv2-only, some parts are GPLv2-or-later (but it's less than the GPLv2-only code).
It will either then be decided invalid in court much later---in which case the CIA has plenty of time to do whatever it is they wanted to do. Or the existing incestuous relationship between the government and the private company will ensure that this remains a grey area of law for a long long time.
More so if software is build reproducibly, signed, and so on.
https://www.ibm.com/developerworks/rational/library/edge/08/...
> GPLv3 adds more clarity with regard to what constitutes a derivative work. For example, GPLv3 states that if the program is "specifically designed" to work with a GPL-governed library, then the library is considered part of the overall work and the entire application is governed by the GPL. However, if one could swap out the GPL library for another library (i.e., if the application wasn't "specifically designed" to work with the GPL library), then it's not part of the overall work and would not be governed by the license.
If I could install ossec and do my own iptables/nftables work on my TV, I find it highly unlikely that a 0 day would slip past my alert filter (most likely it would still work... but unless they are specifically wiping logs, traces, etc...)