MathCAD and FriCAS

[Qian Yun]

MathCAD, since version Prime 6 (in 2019), uses FriCAS as its
symbolic engine, replacing mupad/maple.

I took a look at its latest version Prime 10 (in 2024), and
found that it bundles [2] a copy of fricas-1.3.2 (released in 2017)
with sbcl-1.4.2, with additional 82 NRLIB directory [3]
(which means 82 new domains), around 4600 signatures, [4]
which determined by their names, most are wrapper functions.

Well, generally this feels a bit strange on multiple levels:
1. they use such an old version
2. they don't send bugs or upstream fixes to us

- Qian

[1] https://en.wikipedia.org/wiki/Mathcad
[2] The checksums of *daase are the same as fricas-1.3.2-full.tar.bz2
[3] they are loaded by ")lib" in initial input file.
[4] grep SIGNATURE *NRLIB/index.KAF | wc

[Grégory Vanuxem]

This is surprising, yes, at the limit of being not "fair-play"
(sportsmanship in English but its meaning in my country is more
general than sport activities).

I will give it a try, thank you!

- Greg

> --
> You received this message because you are subscribed to the Google Groups "FriCAS - computer algebra system" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to fricas-devel...@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/fricas-devel/97d6e7d1-10c0-4498-b5f1-a50803cc423d%40gmail.com.

[Ralf Hemmecke]

On 7/3/24 12:19, Qian Yun wrote:
> Well, generally this feels a bit strange on multiple levels:
> 1. they use such an old version
> 2. they don't send bugs or upstream fixes to us

Citing item 2 of our Licence.txt

- Redistributions in binary form must reproduce the above copyright
notice, this list of conditions and the following disclaimer in
the documentation and/or other materials provided with the
distribution.

Honestly, just looking at their website, I do not even see FriCAS
mentioned at all in an easily accessible form. I find this inaccaptable.

I do not have "the distribution", but if it comes without explicitly
reproducing our Licence conditions, then we should certainly react.

Ralf

[Dima Pasechnik]

I recall having a discussion here on whether GPL is a better license.
¯\_(ツ)_/¯

At least GPL would have made them contributing patches etc.



>
> Ralf

>
> --
> You received this message because you are subscribed to the Google Groups "FriCAS - computer algebra system" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to fricas-devel...@googlegroups.com.

> To view this discussion on the web visit https://groups.google.com/d/msgid/fricas-devel/bce74734-2821-406e-905a-54454058da86%40hemmecke.org.

[Waldek Hebisch]

Assuming that ')copyright' works in their copy of FriCAS I think that
they are covered from legal side (IANAL). And assuming that they keep
normal FriCAS banner (identifying binary as FriCAS and giving info about
')copyright') that looks more or less OK.

Concerning bug fixes and patches, in relative terms we got infintely
more from Sage folks, but contribution from Sage folks is rather
small part of overall contributions to FriCAS. So I am not
surprised that there are no visible conftibution from Mathcad.

--
Waldek Hebisch

[Waldek Hebisch]

On Wed, Jul 03, 2024 at 10:39:48PM +0100, Dima Pasechnik wrote:
> On Wed, Jul 3, 2024 at 10:18 PM Ralf Hemmecke <ra...@hemmecke.org> wrote:
> >
> > On 7/3/24 12:19, Qian Yun wrote:
> > > Well, generally this feels a bit strange on multiple levels:
> > > 1. they use such an old version
> > > 2. they don't send bugs or upstream fixes to us
> >
> > Citing item 2 of our Licence.txt
> >
> > - Redistributions in binary form must reproduce the above copyright
> > notice, this list of conditions and the following disclaimer in
> > the documentation and/or other materials provided with the
> > distribution.
> >
> > Honestly, just looking at their website, I do not even see FriCAS
> > mentioned at all in an easily accessible form. I find this inaccaptable.
> >
> > I do not have "the distribution", but if it comes without explicitly
> > reproducing our Licence conditions, then we should certainly react.
>
> I recall having a discussion here on whether GPL is a better license.
> ¯\_(ツ)_/¯
>
> At least GPL would have made them contributing patches etc.

GPL could have forced them to release sources to 82 domains that
they wrote. Or, more likely, they would do the work in their
propritary process (to avoid "linking").

GPL can prevent some parties from using GPL code, but can not
force them to contribute. To give some examples, there are/where
propritarty toolchains for embedded processors, consisting of gcc
+ bunch of propritary programs. AFAIK FSF is OK with this as
long as gcc they use does not contain proprietary modification
and interaction is "normal", that is gcc is called to compile
C/C++ files and they use gcc generated binaries.

In context of CAS I once looked at w website doing symbolic
integration. AFAICS they used modified Maxima. I mean, the
output had a lot of similarity to Maxima output, IMO to much
to be independent creation. But it also could do some integrals
that Maxima could not do, so it was modified. They did not
mention Maxima and of course did not offer source code. AFAIK
GPL allows this (they were just "using" Maxima, but not
"distributing" it).

--
Waldek Hebisch

[Qian Yun]

On 7/4/24 06:41, Waldek Hebisch wrote:
> On Wed, Jul 03, 2024 at 11:18:05PM +0200, Ralf Hemmecke wrote:
>> On 7/3/24 12:19, Qian Yun wrote:
>>> Well, generally this feels a bit strange on multiple levels:
>>> 1. they use such an old version
>>> 2. they don't send bugs or upstream fixes to us
>>
>> Citing item 2 of our Licence.txt
>>
>> - Redistributions in binary form must reproduce the above copyright
>> notice, this list of conditions and the following disclaimer in
>> the documentation and/or other materials provided with the
>> distribution.
>>
>> Honestly, just looking at their website, I do not even see FriCAS mentioned
>> at all in an easily accessible form. I find this inaccaptable.
>>
>> I do not have "the distribution", but if it comes without explicitly
>> reproducing our Licence conditions, then we should certainly react.
>
> Assuming that ')copyright' works in their copy of FriCAS I think that
> they are covered from legal side (IANAL). And assuming that they keep
> normal FriCAS banner (identifying binary as FriCAS and giving info about
> ')copyright') that looks more or less OK.

There were bugs with ')copyright' on windows in older releases.
But their release only includes "algebra/" and "AXIOMSys.exe",
no "etc/" or "share/", so may not include our copy of license.
Or they could hide it in their lengthy EULA, or maybe not.

The banner is fully shown, unmodified.

> Concerning bug fixes and patches, in relative terms we got infintely
> more from Sage folks, but contribution from Sage folks is rather
> small part of overall contributions to FriCAS. So I am not
> surprised that there are no visible conftibution from Mathcad.
>

Sage doesn't develop new domains, MathCAD does. So they are more likely
to hit by bugs.

But as for the "82 new domains" I mentioned above, there is
"EXPR.NRLIB", looks like it is modified for MathcadDisplayCategory.
Other than that, all new domains, which means they really do not
have an internal bug fix tree.

- Qian

[Waldek Hebisch]

On Thu, Jul 04, 2024 at 08:21:35AM +0800, Qian Yun wrote:
>
>
> On 7/4/24 06:41, Waldek Hebisch wrote:
> > On Wed, Jul 03, 2024 at 11:18:05PM +0200, Ralf Hemmecke wrote:
> > > On 7/3/24 12:19, Qian Yun wrote:
> > > > Well, generally this feels a bit strange on multiple levels:
> > > > 1. they use such an old version
> > > > 2. they don't send bugs or upstream fixes to us
> > >
> > > Citing item 2 of our Licence.txt
> > >
> > > - Redistributions in binary form must reproduce the above copyright
> > > notice, this list of conditions and the following disclaimer in
> > > the documentation and/or other materials provided with the
> > > distribution.
> > >
> > > Honestly, just looking at their website, I do not even see FriCAS mentioned
> > > at all in an easily accessible form. I find this inaccaptable.
> > >
> > > I do not have "the distribution", but if it comes without explicitly
> > > reproducing our Licence conditions, then we should certainly react.
> >
> > Assuming that ')copyright' works in their copy of FriCAS I think that
> > they are covered from legal side (IANAL). And assuming that they keep
> > normal FriCAS banner (identifying binary as FriCAS and giving info about
> > ')copyright') that looks more or less OK.
>
> There were bugs with ')copyright' on windows in older releases.
> But their release only includes "algebra/" and "AXIOMSys.exe",
> no "etc/" or "share/", so may not include our copy of license.
> Or they could hide it in their lengthy EULA, or maybe not.

To comply with the our license, they should have text of the
license _somewhere_. Recursive grep for 'Numerical ALgorithms Group'
should find it (unless it is really obfuscated in some way).

> The banner is fully shown, unmodified.

I guess that given name interested folks can use Google to find
FriCAS license. But I do not think that internet counts as
'materials provided with the distribution'.

> > Concerning bug fixes and patches, in relative terms we got infintely
> > more from Sage folks, but contribution from Sage folks is rather
> > small part of overall contributions to FriCAS. So I am not
> > surprised that there are no visible conftibution from Mathcad.
> >
>
> Sage doesn't develop new domains, MathCAD does. So they are more likely
> to hit by bugs.

Not clear to me. Usig Spad code means that they may be affected
by bugs in the Spad compiler. OTOH for simple constructs Spad
compiler was quite reliable. And using Spad they are less
affected by interpreter bugs.

> But as for the "82 new domains" I mentioned above, there is
> "EXPR.NRLIB", looks like it is modified for MathcadDisplayCategory.
> Other than that, all new domains, which means they really do not
> have an internal bug fix tree.

We do not know. In principle they could patch implementations,
that would not change generated databases. If you want to
know you could try testcases for fixed bugs.

Much depends on what they actually use. Some things, like basic
operations on polynomials with integer/rational coefficients are
quite stable, and I do not remember any related bugs. Other things
may be worked around in wrappers.

One, likely possibility is that they developed what they need
around 2018 and keep using essentially the same thing.

--
Waldek Hebisch

[Tim Daly]

I find it hard to believe there is an objection to using software 

and making modification without submitting patches.

[Martin R]

Possibly it makes sense to send a friendly invitation to contribute.  It would seem to me that this would be a win for both parties.

(I have no idea how many people there are behind mathcad)

Best wishes,

Martin

[Qian Yun]

On 7/4/24 09:23, Waldek Hebisch wrote:
> On Thu, Jul 04, 2024 at 08:21:35AM +0800, Qian Yun wrote:
>>
>> There were bugs with ')copyright' on windows in older releases.
>> But their release only includes "algebra/" and "AXIOMSys.exe",
>> no "etc/" or "share/", so may not include our copy of license.
>> Or they could hide it in their lengthy EULA, or maybe not.
>
> To comply with the our license, they should have text of the
> license _somewhere_. Recursive grep for 'Numerical ALgorithms Group'
> should find it (unless it is really obfuscated in some way).

grep shows nothing, can not rule out the possibility of it is
included in binary form.

>> The banner is fully shown, unmodified.
>
> I guess that given name interested folks can use Google to find
> FriCAS license. But I do not think that internet counts as
> 'materials provided with the distribution'.
>

Well, it is a GUI application, I see the banner because I run
"AXIOMSys.exe" directly. I think normal user would not see it.
(I did't run the GUI application because running the evaluation
copy requires registration.)

But in their user forum, some users do find it's FriCAS underneath,
some by poking the directory structure, some by "AXIOMSys.exe is
not responding".

- Qian

[Ralf Hemmecke]

On 7/4/24 03:23, Waldek Hebisch wrote:
> To comply with the our license, they should have text of the
> license _somewhere_. Recursive grep for 'Numerical ALgorithms Group'
> should find it (unless it is really obfuscated in some way).

Yes, that is also how I read the license terms. The contents of our
LISCENSE.txt must be included in the binary of Mathcad and it must be
mentioned in the documentation that comes with the distribution.

And yes, I also see their webpage as "documentation that comes with the
distribution".

Google for "fricas site:mathcad.com". I get an empty search result.

In fact, here I can read:

https://www.mathcad.com/en/blogs/whats-in-prime-7#Symbolics%20Enhancements

"""
Symbolics Enhancements

Mathcad Prime 6 introduced a new symbolic engine to the software,
offering PTC’s software engineers more flexibility as they work with the
software. For you, that means you’ll see modifications and enhancements
that simply weren’t possible in the past.
"""

Well, our license doesn't say that the name "FriCAS" should be
mentioned. However, I do not think that their website shows good behaviour.

> I guess that given name interested folks can use Google to find
> FriCAS license. But I do not think that internet counts as
> 'materials provided with the distribution'.

Yes exactly. And "given name" is a prerequisite for typing something
into google. Unfortunately, I do not find that name (FriCAS) somewhere
mentioned.

>> Sage doesn't develop new domains, MathCAD does. So they are more likely
>> to hit by bugs.
>
> Not clear to me. Usig Spad code means that they may be affected
> by bugs in the Spad compiler. OTOH for simple constructs Spad
> compiler was quite reliable. And using Spad they are less
> affected by interpreter bugs.

Waldek, it sounds as if you do not care much about this issue. Why would
it be so hard for them to mention "FriCAS"? Honestly, I do not know why
they are behaving like this in th first place.

> One, likely possibility is that they developed what they need
> around 2018 and keep using essentially the same thing.

Still, they have to comply to the license.

Ralf

[Dima Pasechnik]

How about telling NAG about the license violation here?
They do have lawyers etc.

Dima

> --
> You received this message because you are subscribed to the Google Groups "FriCAS - computer algebra system" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to fricas-devel...@googlegroups.com.

> To view this discussion on the web visit https://groups.google.com/d/msgid/fricas-devel/9e029a33-ac5e-4344-b3f4-100a69d675d8%40hemmecke.org.

[Waldek Hebisch]

On Thu, Jul 04, 2024 at 02:34:27PM +0200, Ralf Hemmecke wrote:
> On 7/4/24 03:23, Waldek Hebisch wrote:
> > To comply with the our license, they should have text of the
> > license _somewhere_. Recursive grep for 'Numerical ALgorithms Group'
> > should find it (unless it is really obfuscated in some way).
>
> Yes, that is also how I read the license terms. The contents of our
> LISCENSE.txt must be included in the binary of Mathcad and it must be
> mentioned in the documentation that comes with the distribution.

Our license says 'and/or', which probably in practice means 'or'.
In nineties in math institute in Wrocław we were using a few Unix
workstations. OS contained a lot of BSD-licenced code. AFAIR
OS kernel and probably also some other programs printed copyright
messages at startup. But I do not remember seeing BSD copyright
inside documentation. So it is likely that messages printed
at startup count as 'and/or other materials provided with the

Companies frequently behave in this way. And not only companies.
Some years ago Ted Kosan created "Math Piper". Apparently documentation
tried to make impression that this new cool thing. But in fact
this was fork of an existing system. I assume that if you digged
deeper fact that it is a fork would came out. But the intent
was very similar.

--
Waldek Hebisch

[Tim Daly]

I notice that Axiom has a number of licenses, such as Arthur Ralfs

https://github.com/daly/axiom/blob/master/license

which don't seem to exist in the current LICENSE directory.

https://github.com/fricas/fricas/tree/master/license

If the code exists in the source code history the license must remain.

The fact that the code was later removed doesn't matter as the repo still contains it

so the license must still be immediately available, not just in old history.

Almost certainly most of the license material can be found from the initial fork

and the initial site creation at the time of the fork.

I'm not a lawyer but I spent a lot of time and email discussing this with NAG legal.

NAG was very clear that no license or copyright could be removed at any time

which is why some source files still have legal banners. One cannot copy a system,

remove the license from the local copy, and now have a license-free system.

Otherwise you could create a non-GPL copy of any system.

Why were each of these individual licenses removed from the current system?

Tim

[Waldek Hebisch]

On Thu, Jul 04, 2024 at 09:04:03AM -0700, Tim Daly wrote:
> I notice that Axiom has a number of licenses, such as Arthur Ralfs
> https://github.com/daly/axiom/blob/master/license
> which don't seem to exist in the current LICENSE directory.
> https://github.com/fricas/fricas/tree/master/license
>
> If the code exists in the source code history the license must remain.
> The fact that the code was later removed doesn't matter as the repo still
> contains it
> so the license must still be immediately available, not just in old history.
> Almost certainly most of the license material can be found from the initial
> fork
> and the initial site creation at the time of the fork.

Well BSD says that license should be included with the sources, but
does not force you to sprinkle copy of the license to multiple
places. I _think_ that legaly NAG notices in separate files
could be replaced by a single one, but since NAG wanted per file
licence I keep it that way. Similarly with other licences.

As I wrote you most of old stuff that you bundled never was part of
FriCAS repository. New contributions, are covered by overall
LICENSE.txt. Concerning Arthur Ralfs, I do not know why did you
put separate licence file in Axiom. Artur knew Axiom and FriCAS
licence, clearly wanted his code to be included and I included
what he provided. Did he request you to put this licence file?

--
Waldek Hebisch

[Tim Daly]

Per NAG lawyers, "NAG notices in separate files" must remain despite my complaints.

The LICENSE directory policy was put in place shortly after the NAG discussions

based on a compromise NAG lawyers and I agreed to.

It was too long ago for me to remember what Arthur requested.

I suspect he sent code that also had a license file so it was added.

His code is likely still part of your current algebra without his license.

Bill Schelter and I had numerous license / copyright discussions.

https://lists.gnu.org/archive/html/gcl-devel/2003-07/msg00142.html

As for "old stuff, the license.ccl exists because of Arthur Norman discussions

so that license pre-dates even the Axiom open source version. Arthur and

I had several discussions as he was upset that I moved Axiom back to GCL.

I don't know if the original NAG sources I posted are anywhere in your source tree

but those sources contain Norman's CCL.

The CCL license might fall under legal abandonment but that's a question 

I'm unqualified to decide. Ask your University lawyers.

Managing a license is a royal pain. There is a reason Stallman created GPL.

( It gets even worse once copyright and trademarks get involved )

Rather than using GPL, reach out to MathCAD and offer to support and

enhance everything they do. Everybody enjoys help. Once they depend on your

support they are much more likely to continue using your code.

Trying to use GPL to force people to contribute MathCAD changes seems to

conflict with the fact that none of the current codebase changes were ever

submitted  back to Axiom even when the code was just a branch from main.

GPL can't really enforce the "ethics of cooperation".

I'm just happy someone still uses code I wrote 40 years ago.

Tim

[Qian Yun]

Some updates:

1. Attribution:

In the "About" window of MathCAD, it points to a local html page,
which points to www.ptc.com/support/go/open-source-software,
which requires login to see! After login, it points to a
1MB spreadsheet PTC_All_Use_Of_OSS.xlsx, FriCAS is shown
as the 3373-th item.

(There's 18086 items in total. This is not just MathCAD
dependencies, but all PTC products. Also one open source
project can corresponds to multiple lines in this spreadsheet.)

2. License:

Grep can't find even "BSD" or "GPL" in the installation directory.
Only one mention of "MIT" in "font-awesome.css".

I guess they are getting away from including open source licenses
by some fine details in
https://www.ptc.com/en/documents/legal-agreements/on-premise-license-agreements

- Qian

[Tim Daly]

This is in response to the growing requirement for a "Software Bill Of Materials".

The current trend is to require ALL references to ALL software used anywhere

in your source tree or requried to run your code.

Europe has the EU Cyber Resilience Act. The U.S. has an Executive Order.

https://bell-sw.com/blog/u-s-and-eu-regulations-are-demanding-a-software-bill-of-materials-sbom/

So, for example, if you use automake you need to provide a tree entry for

automake as well as all of the trees that automake requires. Similar entries

are required for X, Latex, tar, and other tools. Changing a tool or version

requires updating the SBOM. Replacing X11 with Wayland would require

a new subtree for Wayland as well as the old X11 as the repo still has an

old X11 version available in history.

It should be clear why there are 18068 entries in their SBOM.

There are "recognized formats" for including and storing the SBOM.

With enough pressure on Microsoft, the owner of github, I expect they will

requires an SBOM on all repositories in the near future.

Tim

(NOTE: the following seems wildly off-topic but you need to understand why

things like SBOMs are vital. It is not enough to write free code these days.

The code you write is dangerous.)

This all seems ridiculous to any software developer. But if you use an old

version of some HTML thing to create your book PDF it is entirely possible

that your software is responsible for including a bug that brings down the

power network, banking infrastructure, or other vital services. It takes a very

long time to figure out that MathCAD used your code to create an image that

contains malware that infects every computer that displays the image.

(I spent a decade doing cyber-security and malware research.)

The world is at war right now, you just don't see it. For example,

https://therecord.media/cosmicenergy-malware-russia-critical-infrastructure-power-grid

or another example

https://msrc.microsoft.com/blog/2024/01/microsoft-actions-following-attack-by-nation-state-actor-midnight-blizzard/

and even software that can cause physical damage that could take a year to repair

https://www.wired.com/story/how-30-lines-of-code-blew-up-27-ton-generator/

You could be responsible for destroying worldwide shipping.

https://community.mis.temple.edu/mis5214sec005spring2021/files/2020/03/MIS5214_Unit8_CaseStudy2_Maersk.pdf

It's not you, right? You're just using Latex (an attack vector) to convert to

PDF (an attack vector) and include text in the image (an attack vector)

which will create an image (an attack vector) that will be displayed on the

homepage (an attack vector). Surely you checked the SBOM against the

known attack vectors versions to ensure you're not including malware, right?

Nah, images are harmless.