The initial injustice of proprietary software often leads to further injustices: malicious functionalities.
The introduction of unjust techniques in nonfree software, such as back doors, DRM, tethering, and others, has become ever more frequent. Nowadays, it is standard practice.
We at the GNU Project show examples of malware that has been introduced in a wide variety of products and dis-services people use everyday, and of companies that make use of these techniques.
(Please note that this article misuses the word "hack" to mean "break security.")
A good privacy law would prohibit cars recording this data about the users' activities. But not just this data—lots of other data too.
DRM in Trains
Proprietary Insecurity in LogoFAIL
4K UHD Blu-ray Disks, Super Duper Malware
This is a reminder that angry users still have the power to make developers of proprietary software remove small annoyances. Don't count on public outcry to make them remove more profitable malware, though. Run away from proprietary software!
New article by Richard Stallman: https://www.gnu.org/philosophy/the-moral-and-the-legal.html
In his speech at the University of Pisa on June 7, Richard Stallman
addressed the topic of machine learning systems (so-called "artificial intelligence") and answered the question of whether the training data should be released.
29:00 - 54:00 and 58:40 - 1:04:00 in the video.
Alexandre Oliva, maintainer of GNU Linux-libre, was interviewed by Nix Sanctuary:
https://nixsanctuary.com/an-interview-with-alexandre-oliva-lead-developer-of-linux-libre-at-fsfla/
> - What is your key role in Linux-libre development at the moment?
> Would it be wrong to call you Mr Linus of Linux-libre?
I'm a janitor, which is honorable and purposeful, requires some skill and sometimes intense labor, but is not comparable to the effort, responsibility and leadership positions of e.g. Mr Torvalds in the kernel Linux, or by Dr Stallman in the GNU Project.
I am in charge of figuring out what needs to be cleaned up, and what can stay, and of not making too much of a mess in the process so that, once I take the garbage out, things remain functional. Of course I'm talking about things that don't run on garbage. Those that do are fundamentally incompatible with my job, and with your freedom.
Now, I'm a bit of a hi-tech janitor, so instead of just cleaning things up myself, I also teach some bots to do the cleaning, and to look for garbage, so I don't have to do that over and over and over. So most of the time I, and more recently co-maintainer Jason Self, can just call the robots in when a new upstream release is out, and then check that they've done their job well, adjusting as needed.
> - How is Linux-libre different from the Linux kernel? Is it all
> about the binary blobs? Or is there much more to it in terms of
> security, privacy and open hardware development?
I generally prefer to write "kernel Linux", because "Linux kernel" is often misunderstood and mistranslated as if it meant "kernel of Linux". That makes no sense, given that Linux is a kernel, but a lot of people have been misled into believing it is more than a kernel.
Linux-libre is a slightly modified version of the kernel Linux. We strive to make minimal changes to make Linux compliant with the GNU Free System Distribution Guidelines.
This means removing a few blobs (there used to be tons of them, but in recent releases they're down to less than a handful), so that it becomes Free Software, and disabling requests for blobs, as well as error messages and documentation, that could mislead users into installing blobs. Blobs are inherently freedom-depriving programs.
The goal is for the kernel package to become wholly respectful, obedient and friendly to users. I don't mean "user friendly" in the hypocritical sense it has taken, of fake polished politeness to attract users and enable their abuse and betrayal behind their backs. I mean really friendly, trustworthy even, in that it won't coerce or mislead users into engaging in such self-harming behaviors as installing blobs, or giving third parties control over their computing and their lives, thus giving up their freedom.
We disable blob loading, but that's a bug, not a feature. Alas, it's not fixable without sacrificing the goal. Allow me to unpack that:
We acknowledge and respect users' informed decisions to install and run blobs, despite their negative consequences on everyone around them. On the one hand, we're sad that they're subjugated (through the blobs) in their computing; on the other, we don't wish to prevent users from carrying out their informed decisions. We do, however, oppose the leading and the luring directed at users for them to install, load and run blobs.
Disabling their loading, even if reversible (by changing the code back), is far from ideal: it is too far-reaching a measure for the intended goal.
Unfortunately, it doesn't seem possible to enable their loading in a way that doesn't also enable some hostile installer, upon noticing the kernel's looking for certain blobs, to tell users that those blobs are needed and have to be installed. This would amount to inducing users to self-harming behavior, namely, to accept mistreatment whose full extent and significance they cannot comprehend, and are actively prevented from understanding.
Some nasty installers go beyond inducement, and decide on their own to go ahead and install the blobs, without even telling the user, or asking for consent for the mistreatment, which I find very unfriendly and disrespectful.
Summing it up, it is not our goal to prevent users from loading and running blobs they choose to install, only to avoid inducing them to do so. However, Linux-libre is designed to fulfill our goal, of neither imposing freedom-depriving software on users, nor luring them to such software, even in user-hostile environments that would turn the kernel's attempts to load files known to be blobs into requests for installing them. So we have to disable those attempts.
Ironically, most of our users don't run it on such hostile systems, and even if they did, they're most often running it on hardware that doesn't require the kernel to load blobs anyway. To avoid loading blobs is exactly what our users are looking for, so they don't mind the disabling. In fact, when they find out some hardware component requires blobs to run, their disappointment is correctly directed at the hardware manufacturer, and they appreciate that we help them identify and avoid the problem.
> - Do you consider the default kernel included in the current Debian
> stable version 11 to be libre? If not, why not?
I only have second-hand information, but I'm told the kernel that ships with Debian GNU/Linux is cleaned up to the point that it, the kernel package, does not contain any blobs itself. If that is indeed correct, it qualifies as libre.
However, it doesn't abide by the Free System Distribution Guidelines, because it requests (thus induces users to install) blobs.
Debian has long fallen prey to the fallacy that serving users is at odds with serving users' freedom, so it recently adopted the very kind of hostile environment to users' freedom that worries us: it detects hardware that won't work without blobs, and proceeds to enable the installation of these blobs, which would give the blobs (and thus those who control them) control over the user's devices.
They claim this does good to users, but what it does is help vendors perpetuate the problem of taking freedom away from their customers. When someone teaches users that the chains look good on them, they will fight for the chains and for those wielding them, and against us who tell them they don't deserve this mistreatment.
Of the people misled into fighting for the mistaken virtue of being chained and of sharing chains with others, some see the mistake after a while, and join our fight for freedom, but most don't, and some of these will even become Debian Developers, and decide on its future policies.
It's a very harmful dynamics. When one is made hostage (as in, "if you don't install this blob, I will refuse to work"), that distorts perceptions and clouds the judgment, it doesn't help one make good decisions.
Truth is, users don't need Debian or system distributor to package and deliver these blobs to them. They already have a copy of every needed blob in driver disks that shipped with the devices. Debian could have chosen not to distribute the blobs, and instead e.g. offer to fetch them from driver disks, offering the convenience of packaging and shipping and updating only to freedom-respecting software, as Debian founders intended. Users would then loathe the experience of going for the driver disks, as they should because they're user-hostile and freedom-depriving, and they would then prefer hardware that doesn't require them to jump through such hoops.
Debian could have chosen to highlight the problem to encourage users to demand correction of it, which could avoid the perpetuation and growth of the problem of binary-only blobs' taking control of our computing devices, but it now accommodates the problem, helps users overlook it, and encourages them to accept it. They reinforce the misguided feeling that chains look good. That's all very unfortunate.
> - Where do you get the motivation to continue the project if
> everything falls apart? Is Free Software commercially successful?
> What is your personal opinion?
I've worked with, on and for Free Software my entire adult professional life. I enjoy programming and using computers, and that, to me, requires a freedom-respecting operating system, and only freedom-respecting programs running on it. Without a free kernel, the operating system wouldn't be free, so I wouldn't be happy using it. Fortunately, I figured out a way to clean it up that requires a very moderate amount of effort as to be sustainable, so I don't envision things falling apart.
Having devoted almost a quarter of a century to developing commercial Free Software, and having managed to buy a nice place to live, to raise our daughter along with my life partner, to save for retirement, all while working part time so as to be able to devote a significant amount of my time to Free Software activism, I'm living proof that it can be viable. Realizing that, all this while, my labor was being exploited for others to profit, even while I was being reasonably well paid, suggests to me that it can be quite profitable too.
But that's not how I measure success. Living an ethical life, being free to pursue what is right, devoting my time and effort to make the world a better place... I find these a lot more successful than extracting the last bit of value from one's customers, workers, and partners.
> - What specific problems are you currently facing with Linux-libre
> on modern hardware, especially laptop PCs?
Modern x86 hardware is pretty much hopeless when it comes to user freedom. Not the ISA itself, but microcode blobs, as well as Intel ME and AMD's analogous remote-control misfeature make them very hostile. We should be going for the lifeboats rather than listening to the violins. I recommend sticking to old computers compatible with Libreboot(the GeNUine one, not the blob-ridden renaming of osboot), until competing hardware architectures that are more freedom-friendly take over.
Most everyone's personal computing needs can be met with 15-year-old x86 hardware, which is unfortunately getting hard to find, but other architectures have already overtaken a lot of people's computing needs, and there are freedom-respecting choices coming up, so I expect there will soon be plenty of choice with freedom. It's a future that a number of people are working hard to build, and I hope you will support, recognize and reward their efforts.
> - What is on your wish list for the near future? Will we see
> additional features in Linux-libre compared to the Linux kernel?
> Just like custom ROMs on Android OS give us added benefits over the
> stock ROMs. or just like custom firmwares on routers like *WRTs give
> us better access to the same hardware with more features locked by
> the proprietary software.
Our goal is to track upstream Linux as closely as possible, with minimal changes, just enough to abide by the Free System Distribution Guidelines. When we find out hardware works without blobs, but drivers insist in denying users service when blobs are not loadable, we tweak those too, but those are rare. These are our only features, by design. Any other features might as well be integrated upstream, and we'll pick them up. Heck, enabling hardware that works without blobs to do so used to be and should be upstream too, but they don't want it that way.
I hope some day there won't be blobs to clean up from Linux any more. I dream of some blob loading API that doesn't enable hostile systems to decide to install blobs on behalf of users, or induce them to install blobs. I have a hunch of a formal proof that no such API can exist, but that's what makes it a dream rather than a goal.
For those interested in the proof, the jist of it is that any feature the kernel could rely on to ask userland or a filesystem whether a blob is installed could be abused by a hostile installer: it would present to the kernel the list of blobs that it knows about, rather than those that are actually installed, and it would then (offer to) install them when the kernel attempted to load them.
For example, even if the kernel were configured to only looking for firmware directly in the filesystem, within /lib/firmware, rather than relying on a userland program to locate and provide the firmware files, a hostile installer could fuse- or nfs-mount /lib/firmware from a filesystem implementation that drew information from a database of installable packages, and offer file listings and metadata for all installable blobs.
> - What is the main goal of the project? Can you say that Linux-libre
> has seen significant adoption in the commercial world?
Oops, I think I've just answered the first part of this question in the previous one.
As for the second part... I wouldn't know. I make it because I need it, because I know a decent way to do it, and I'm happy to share with others, but it's not important for me to know how many others use it or enjoy it. I don't think that information would do me any good, and most such data gathering is invasive anyway.
> - Do you think Rust will simplify kernel development and your tasks?
I don't see how it would change anything that I deal with maintaining GNU Linux-libre. I wish Rust could reduce the amount of blobs and of blob requests in Linux, but really, rust is about oxidation rather than reduction.
Now, seriously, Rust is just as capable of carrying and of requesting blobs as C, so it won't change anything for us. I wonder how long it will take for the first blob request or blob proper to appear in a piece of Rust code in Linux.
As for kernel development... I'm afraid I don't know much about that. I am fond of safety in programming languages, but I don't know much about Rust specifically, and I have no clue on whether Rust can live up to the hype.
> - What's your favourite machine/hardware that you currently use for
> work and play?
My senior warriors are Thinkpads x200 and t400, from the time when Intel ME malware could still be fully removed without causing machines to spontaneously reboot within minutes. These computers are aging, but they're still able and willing to fight by my side.
I still own a couple of old Lemote Yeeloong MIPS64 machines, and they served me well, but they aren't very useful any more. Running a non-x86 architecture was a nice experience, though, and I miss it more than the blank stares I got when I talked about it.
I look forward to freedom-respecting, affordable and more powerful computers based on such architectures as AArch64, RISC-V, and Libre-SoC/OpenPower, and they seem to be around the corner.
> - Do you play games? What is your favourite video game?
I've been spending far too much time playing FreeOrion lately. I'm also quite fond of 0AD and TORCS, but they're a bit more demanding of the CPU and of the GPU than my senior warriors can deliver at this time. I need to get their thermal paste replaced so that they don't overheat when I play those games.
> - Do you think that supporting GNU Linux or Linux-libre is much more
> expensive for OEMs than shipping Microsoft Windows? Have you ever
> had these discussions internally?
I'm not clear on what "internally" stands for. Like, discussing within myself? Within the project, some organization, some company? I think I have taken part in such conversations quite often all over indeed. The struggle for emancipation and autonomy, and against digital colonization, has been quite an important part of my life, and discussing and understanding the forces that sustain undesirable circumstances are an important part of figuring out how to fight them.
Microsoft has abused its monopoly position to force OEMs to tax their customers even on computers that ship without Windows, arguing that buyers would install it anyway, and charging a larger price per unit from OEMs who wouldn't preload Windows on all their products. That alone makes shipping other systems more expensive for OEMs than shipping Windows, but that's because the baseline artificial inflated cost is traceable back to Microsoft, and it tells us nothing whatsoever about the actual cost of shipping and supporting a freedom-respecting system.
Meanwhile, back when Brazil had policies to promote computers preloaded with GNU/Linux, Microsoft bribed retailers to tell buyers that the system didn't work, that they'd want to install Windows, and that the retailers could do it for them. That would in theory lower the support costs for OEMs, because customers wouldn't even be entitled to support after replacing the original system with a Windows Limited Edition, but I'm told it led to many returns and refunds because that Windows version was so limited. That programme was doubly sabotaged.
Market forces focus on offering the illusion of choice rather than actual choice, and they do so by buying-out or driving out of the market the alternatives that would be more advantageous to buyers, so that what's left, even if not from a single monopolist, sucks in about the same way. So it's not really a matter of costs.
But, like every powerful lie, the notion that switching away from Windows to GNU/Linux is costly has a kernel of truth. If you're used to a certain system, switching to a different one will involve a transient situation in which the new system appears to be more difficult, require some learning and getting used to. But that's transient, and only once those difficulties are overcome can you tell which one truly is more costly to maintain in the long run.
The switching costs do not seem inviting at any point in time, but once you get past them and start gaining in freedom and saving in costs, you quickly make up on the switching investment. But lock-in tends to artificially inflate the costs, not of the transition proper, but of breaking the locks put in precisely to prevent switching: saving data in secret formats; keeping data stored remotely, out of customers' hands; blocking access to data when a contract is terminated... The bag of tricks to lock users in is huge, but these are all costs that should be accounted against the source of the problem, not of the solution. Not everyone can see through the trap, though.
> - What distribution do you personally admire?
Those that keep a commitment to avoid contamination with user-hostile software, and to avoid inducing users to shoot themselves in the feet. The lists of recommendations are maintained at <https://www.gnu.org/distros/>.
There are a few other distros that seek inclusion in these lists. I hope they succeed.
> - What was your first computer? Did you ever use Windows or Mac? If
> you had to switch from GNU Linux-libre today for professional
> reasons, which of the two would be the safest choice, and why?
My fascination started at an uncle's place. He first assemble a Pong machine, then got a Sinclair ZX Spectrum clone, onto which I'd type programs printed on magazines. We're talking about late 1970s. Back home, I wrote my first program on a programmable calculator in 1980. It had a KiB or so of RAM for BASIC programs. Then we had a TRS-80 Model III clone, an Atari video-game, a Commodore C64, an x86 PC, an MSX... I had friends in my teens that owned Apple II, Commodore Amiga, and Atari computers, and I spent a fair amount of time "working" on IBM PC clones running MS-DOS, and even on older CP/M machines with 8" floppy disks back then.
Then I moved to attend college, and though I brought that first x86 PC with me, it didn't take me long to gain access to Unix machines at the university, to be fascinated by them, to come across GNU (Linux was yet to be announced at that time), and so I skipped the whole Windows era. Some of the servers in the server room of the department where I was sysadmin assistant ran Windows and OS/2, but someone else took care of them.
I recall for some time I used a (pre-Unix) MacOS-running machine as a display server, after years on dumb text terminals, and but that was about it. I may have had contact with Macs and Windows for projects here and there, but they never took hold of me. After several years, I found myself switching from managing systems with GNU on top of a proprietary Unix to GNU on Linux.
So I was never really used by Windows or Darwin-based systems, but that was mostly accidental. I hadn't grasped the notion of software freedom yet as to reject them outright, I was just interested in programming and in sharing software, and GNU happened to be on my path and resonate with those interests. When I was younger, software was not covered by copyright in Brazil, and friends shared software liberally, and I saw that this was good.
Thinking about this question reminded me of an episode I lived in my early teens. A friend shared a program with me, I liked it and wrote to praise the author. But he expected to sell copies of the program, very much like Bill Gates in his open letter to hobbyists, so his response to a teen's praise letter was to berate me and my friend before the BBS community, and contact my parents to teach me a lesson. I have no recollection of the circumstances that ensued, I suppose I removed and never used the program again, but it seems that, deep down in my mind, I learned a lesson: though I enjoyed programming and expected my then-future professional life to involve programming, I didn't want to be like that! I suppose I should thank him for showing me the wrong way so clearly, for giving me an episode similar to Stallman's laser printer driver's, but I'm afraid I do not recall his name, nick, or even the program.
Anyway, I learned and grew serious about using only Free Software, as I yearned for software that didn't strive to tie my hands and put a blind on my eyes, to keep me from learning and hacking and sharing. When I came across GNU, and read about why it came to be, I realized that that was what I wanted to be like.
I can't picture myself relying on Windows or Macs for any computing activity of mine, not even for work. My conscience won't allow me to take even comparatively much smaller abuses. I guess positions that required Windows or Macs just aren't meant for me. I hope we can build a society in which they're meant for nobody.
> - To the young people who, like me, admire you and the principles of
> Free Software, and yet fail to adopt a truly free GNU Linux
> distribution. What is your message? Do you have any book
> recommendations for newbies who want to learn GNU Linux?
Being overpowered, becoming a victim of injustice, those are not circumstances to be ashamed of. But it's important to try to figure out what brings the injustice onto you, and then try to find a path towards minimizing and eventually avoiding it. Ideally, figured out how to put an end to it for everyone.
> - What should a non-coder, intermediate GNU Linux user know about
> kernel security? Any books you recommend for non-developers?
First, allow me to clarify an apparent confusion: "GNU Linux" suggests that Linux is a GNU package, like "GNU Emacs", or "GNU coreutils", or "GNU libc", but this is not the case. There's no GNU package named Linux. Linux is an independent effort, initially intended to develop a complete operating system for PCs (not big and professional like GNU, as Mr Torvalds put it then), but that ended up realizing GNU was what they wanted, except that it didn't have a kernel yet. So they focused on developing the missing part, that came to be named Linux, and on making it work with GNU. Because Linux later on ended up integrating blobs, GNU came to have its own version of Linux, called Linux-libre for short, or GNU Linux-libre for the full name. But by "GNU Linux" I suppose you meant GNU/Linux (that I read as GNU on Linux), or GNU+Linux (that I read as GNU with Linux), two reasonable ways to refer to the combination of the GNU operating system with the kernel Linux. I appreciate that you made it a point to mention GNU, a lot of people end up, intentionally or not, supporting the suppression of knowledge about GNU and about the struggle for freedom and justice that brought it into existence.
> - Most young people are into Android or iOS development. Can they
> have similar opportunities in the Free Software or GNU Linux world?
> If so, how should they go about it?
The entire mobile computing field is so full of TRApps that at the same time I sort of hope they don't, and wish they succeed immensely at it.
We really need to bring back notions of portable, standards-compliant, system-independent programs and services, instead of ones that lock people in. GNU, BSD, and Unix SysV programs, as well as other Unix-targeted utilities back in the 90s, were available in source form, and could be readily built on all sorts of flavors of Unix, different hardware architectures and all.
But dominant mobile operating systems are all locked-down, incompatible walled gardens. Every time some government or company publishes non-Free Software for these dominant mobile platforms, it gets harder for us to live in freedom.
I found that to be the major roadblock for the 0G Project, and I don't see an easy solution for it. Developers, companies and governments are going to keep on pushing undesirable software down our throats as long as we swallow it, so if we don't wish to become foie gras informatique (pardon my French), we need to educate ourselves to resist, to stop funding and supporting our own abusers.
> - How important is self-hosting an email server when many of them
> are losing out to the big tech companies?
Email used to be a great example of federated service with standards and multiple compatible implementations, but we mostly lost it to centralized webmail silos. It is not only possible to run one's own email server, it's very important that more people do so, to revert this trend of centralization. Right now, the few major webmail (not to be confused with email) providers have far too much power in their hands. We need to redistribute that power.
> - What is the role of Linux-libre in server hosting and services? I
> rent a virtual machine to host this blog myself. How important is
> the Linux-libre kernel on a virtual machine independent of the host
> system?
I hope VM hosts choose freedom for themselves, but whether or not they do is not so important for their guests; virtual machines, to the best of my knowledge, are not affected by hardware blob requirements: VMs everywhere could be running GNU Linux-libre if their users so chose, whether or not their hosts did.
It would be mostly symbolic, since when hardware doesn't demand blobs, blobs aren't requested, loaded or executed. But it would be a positive development to change the defaults. Defaults matter a lot.
If I were to hire such services, I'd rather choose hosts that understand freedom, privacy, security and sustainability issues and that are thus less likely to be fooled or entrapped, which could ultimately disrupt the service I expect them to provide. So, I'd prefer providers that relied on fully Free Software, even when their choices as to their own computing didn't affect my freedom.
> Every year we hear that this is the year of the GNU Linux
> desktop. But the mood in the social channels on IRC or in the forums
> of most distributions tells a different story. The hope that GNU
> Linux will ever become a popular choice in the home or small
> business is slowly fading in reality. One problem is that GNU/Linux
> doesn't come standard with systems sold by popular PC vendors, and
> most people don't bother to install it.
> What is the reason? Is it the lack of affordable support services in
> the GNU/Linux world? Do you think a joint effort [by most Free
> Software distributions] to offer a subscription with
> phone/email/chat support at the consumer level would help?
Monopoly-induced inertia is very hard to overcome. It's truly amazing how Free Software has conquered the fields of high-performance computing and servers. We have built several great desktop systems, and even the dominant mobile platforms were based on systems that were freedom-respecting.
In most of the fields in which users realize and fight the obstacles, difficulties, costs and inconveniences imposed through freedom deprivation, freedom-respecting software has largely prevailed, and monopolies have fled to other fields or, in some cases, to other layers in the computing stack. We see that repeated pattern of either fighting and overcoming or neither in academia, in the largest retail chains, in telecom, in banking, in hosting, the list goes on and on. Poor choices of the past affected quite significantly the bottom lines of the biggest companies that depended on third-party proprietary software; they had the means to realize the origin of their problems, and the drive and motivation to seek, build and pursue solutions, and the IT market reacted to that.
But when it comes to consumers, we are mostly disorganized, exploited, underinformed as to our own individual stakes, and overexposed to peer and market pressures, so dominant market forces keep on trafficking products that cause dependency on their users. So users are now being led away from general-purpose desktop computers towards portable telescreening devices.
When it comes to "legacy" unfettered computing devices, we already have plenty of community support, it's as affordable as it can get, it's unmatched in motivation, and it's truly great for the most part, at least when the providers are treated like cooperating gift-givers rather than as exploitable serfs. Nobody likes to be treated like an exploitable serf.
For those who'd rather have service level commitments, the choices are there too. So lack of it can't be the problem, more so if you consider how bad the corresponding proprietary offerings are, and how helpless a user ends up when they inevitably fail to deliver. And the proprietary offerings do fail to deliver, because the paying customers are the exploitable serfs in that picture.
Now, if I knew the solution for the problem of how to overcome monopoly-induced inertia, if it was readily achievable, I promise you we'd be there already. But most people tend to keep on making the same mistakes that those around them made before, even without liking it. This explains a lot of long-term societal problems including this one. The system relies on that weakness of ours to keep us dominated and exploited. It takes a lot of courage and effort to part with such bad habits. Fortunately courage is contagious, so there's hope, but it will take much effort!
> What federated chat or IM software/services do you use and recommend
> in times when "cloud-based" "multi-device" "auto-syncing" non-free
> messaging services with shoddy implementations of transit encryption
> are in vogue? Is XMPP popular in the libre community you belong to?
> Do you use it?
I use the traditional IRC for a number of Free Software-related conversations, the incredibly extensible XMPP (the X is for extensible) for private and group communication, and more recently the wonderful award-winning GNU Jami for secure multi-device peer-to-peer instant messaging, audio and video conferencing and file transfer.
> Last question, what is your favourite book, song and film? :) Have
> you seen the film
> [[Snowden|https://en.wikipedia.org/wiki/Snowden_(film)]]?
I don't think I have a favorite song. I had several over time, but that it kept changing tells me there's not one favorite.
I have a collection of favorite movies, too many to mention, but the ones I keep going back to, for so many reasons related with my activism, are the Matrix series. They offer images I've often resorted to in my writings and speeches: Free Software and the Matrix was quite a hit back in the day, and I keep returning to the series https://www.fsfla.org/~lxoliva/#Hackersagain and again and again.
As for books, George Orwell's 1984 is probably at the top of my list, with Douglas Adams' Hitchhiker's Guide to the Galaxy series coming in a close second, at least counting by how many times I've reread them.
I did watch Snowden, I enjoyed the dramatization, but in my mind it has an effect of blurring the lines between the reality of Citizen Four, of Permanent Record, and the dramatized action. I often find myself wondering whether certain scenes I reconstruct with my imperfect memory come from the documentary, the book, or this movie, and the uncertainty as to where I got it from makes me a little uncomfortable: it resembles a bit the discomfort of not trusting one's own senses or memories that is so present in 1984.
Happy hacking!
Shared from <http://www.fsfla.org/anuncio/2023-02-Linux-libre-15>
It was February 2008 when Jeff Moe announced Linux-libre, a project to share the efforts that freedom-respecting distros had to undertake to drop the nonfree bits distributed as part of the kernel Linux.
> "For fifteen years, the Linux-libre project has remained dedicated
> to providing a kernel that respects everyone's freedom and has
> become an essential part of the free software movement. Linux-libre
> is widely used by those who value their freedom to use, study,
> change, and share software without restrictions or limitations.
> These freedoms are essential to creating a just society."
> -- Jason Self
Since around 1996, Linux has carried sourceless firmware encoded as sequences of numbers disguised as source code. UTUTO and gNewSense pioneered the efforts of removing them. Cleaning Linux up is a substantial amount of work, so the existence of Linux-libre has alleviated one of the main difficulties in maintaining GNU+Linux distros that abide by the GNU Free Software Distribution Guidelines. The Linux-libre compiled kernel distributions maintained by Jason Self, Freesh (.deb), liberRTy (low-latency .deb) and RPMFreedom (.rpm), make it easy for users of other GNU+Linux distros to take a step towards freedom when their hardware is not too user-hostile.
> "Thanks to Linux-libre, we have entirely libre GNU+Linux distros.
> Thanks to Linux-libre, people like me who are not kernel hackers can
> install one of those distros and have a computer which never runs a
> nonfree program on the CPU. (Provided we use LibreJS as well to
> reject nonfree Javascript programs that web sites send us.)"
> -- Richard Stallman
Early pieces of firmware in Linux ran peripheral devices, but some of the blobs loaded by Linux nowadays reconfigure the primary central processing units and others contain an entire operating system for the peripherals' CPUs, including a copy of the kernel Linux itself and several other freedom-depriving programs!
After years of our denouncing the social, technical, and legal risks out of Linux's misbehavior, most of the blobs got moved to separate files, still part of the kernel Linux, and then to separate packages, which mitigates some of the legal risks, but the problem keeps growing: more and more devices depend on nonfree firmware and thus remain under exclusive and proprietary control by their suppliers.
For 27 years, the nonfree versions of Linux have shown that tolerating blobs and making it easy for users to install and accept them makes users increasingly dependent on user-hostile, blob-requiring devices for their computing. Refusing to give these devices' suppliers what they wish, namely your money and control over your computing, is more likely to succeed at changing their practices if more users refuse.
If you're the kind of software freedom supporter who demands respect for your freedom, keep on enjoying the instant gratification that GNU Linux-libre affords you, and supporting (or being!) those who refurbish old computers and build new ones to respect our autonomy.
However, if you're of the kind for whom last-generation computers are hard to resist, even though you'd prefer if they were more respectful of your freedom, you may wish to consider a delayed gratification challenge: if you and your friends resist hostile computers now, you may get more respectful ones later, for yourselves and for all of us; if you don't, the next generations will likely be even more hostile. Are you up for the challenge?
GNU Linux-libre releases are currently prepared with scripts that automate the cleaning-up and part of the verification. For each upstream major and stable release, we run the scripts, updating them as needed, and publish them, along with the cleaning-up logs and the cleaned-up sources, in a git repository. Each source release is an independent tag, as in, there are no branches for cleaned-up sources. This is so we can quickly retract releases if freedom bugs are found.
We have plans to change the cleaning-up process and the repository structure in the future: we're (slowly) preparing to move to a rewritten git repository, in which, for each commit in upstream Linux main and stable repositories, there will be a corresponding cleaned-up commit in ours. Undesirable bits are going to be cleaned up at the commit corresponding to the one in which upstream introduced or modified them, and other modifications will be checked and integrated unchanged, mirroring the upstream commit graph, with "git replace" mappings for individual commits and, perhaps, also for cleaned-up files.
This is expected to enable us to track upstream development very closely, to get stable and major releases out nearly instantly and often automatically and to enable Linux developers to clone our freed repository instead of our upstream to write and test their changes. The same techniques used to create the cleaned-up repository can be used to fix freedom bugs in it.
Jason Self has made several beautiful pictures of his version of Freedo, our light-blue penguin mascot, and we've used them for our recent releases.
Marking the beginning of the week in which we celebrate 15 years of Linux-libre, we had the pleasure of publishing a major release, 6.2-gnu, codenamed "la quinceañera", with a picture of Freedo dressed up for the occasion: <https://www.fsfla.org/pipermail/linux-libre/2023-February/003502.html>
But there's more! He also made a commemorative black-and-white wallpaper with classic Freedo, also dressed up for the occasion. Check them out, and feel free to tune the colors to your liking! <https://linux-libre.fsfla.org/#news>
He also modeled a 3D Freedo in Blender, and we're looking for someone who could 3D-print it and get it to the FSF office in time for the LibrePlanet conference. Rumor has it that Richard Stallman is going to auction it off to raise funds for the FSF! Can you help?
GNU Linux-libre is a GNU package maintained by Alexandre Oliva, on behalf of FSFLA, and by Jason Self. It releases cleaned-up versions of Linux, suitable for use in distributions that comply with the Free Software Distribution Guidelines published by the GNU project, and by users who wish to run Free versions of Linux on their GNU systems. The project offers cleaning-up scripts, Free sources, binaries for some GNU+Linux distributions, and artwork with GNU and the Linux-libre mascot: Freedo, the clean, Free and user-friendly light-blue penguin. Visit our web site and Be Free!
Richard Stallman announced in September 1983 the plan to develop a Free Software Unix-like operating system called GNU. GNU is the only
operating system developed specifically for the sake of users' freedom: <http://www.gnu.org/gnu/the-gnu-project.html>
In 1992, the essential components of GNU were complete, except for one, the kernel. When in 1992 the kernel Linux was re-released under the GNU GPL, making it Free Software, the combination of GNU and Linux formed a complete Free operating system, which made it possible for the first time to run a PC without non-Free Software. This combination is the GNU+Linux system: <http://www.gnu.org/gnu/gnu-linux-faq.html>
Free Software Foundation Latin America joined in 2005 the international FSF network, previously formed by Free Software Foundations in the United States, in Europe and in India. These sister organizations work in their corresponding geographies towards promoting the same Free Software ideals and defending the same freedoms for software users and developers, working locally but cooperating globally.
New article by Richard Stallman, On Privacy at School.
The GNU Education Team has published a new article by Richard Stallman on the threats of Big Tech in the field of education.
Human Rights Watch studied 164 software programs and web sites recommended by various governments for schools to make students use. It found that 146 of them gave data to advertising and tracking companies.
The researchers were thorough and checked for various snooping methods, including fingerprinting of devices to identify users. The targets of the investigation were not limited to programs and sites specifically “for education;” they included, for instance, Zoom and Microsoft Teams.
I expect that each program collected personal data for its developer. I'm not sure whether the results counted that, but they should. Once the developer company gets personal data, it can provide that data to advertising profilers, as well as to other companies and governments, and it can engage directly in manipulation of students and teachers.
The recommendations Human Rights Watch makes follow the usual approach of regulating the use of data once collected. This is fundamentally inadequate; personal data, once collected, will surely be misused.
The only approach that makes it possible to end massive surveillance starts with demanding that the software be free. Then users will be able to modify the software to avoid giving real data to companies.
More at gnu/education...
Richard Stallman at the First Hackers Conference
The first Hackers Conference was held in Sausalito, California, in November 1984. The makers of the documentary Hackers: Wizards of the Electronic Age interviewed Richard Stallman at the event. They included only parts of the interviews in the film, but made some other footage available. Stallman's statements at the conference went beyond what he had written in the initial announcement of GNU.
It was at this conference that Richard Stallman first publicly and explicitly stated the idea that all software should be free, and makes it clear that "free" refers to freedom, not price, by saying that software should be freely accessible to everyone. This was probably the first time he made that distinction to the public.
Stallman continues by explaining why it is wrong to agree to accept a program on condition of not sharing it with others. So what can one say about a business based on developing nonfree software and luring others into accepting that condition? Such things are bad for society and shouldn't be done at all. (In later years he used stronger condemnation.)
Here are the things he said:
Video
Video
Video
The nonfree app Along, developed by a company controlled by Zuckerberg, leads students to reveal to their teacher personal information about themselves and their families. Conversations are recorded and the collected data sent to the company, which grants itself the right to sell it.
The world urgently needs a free program that can subtract background music from a field recording.
The purpose is to prevent censorship of people's video recordings of how cops treat the public.
A student of Computer Science in Poland fights back proprietary software at his university and manages to graduate using only free software.
by Wojciech Kosior
As a university student, I have struggled during the pandemic like everyone else. Many have experienced deaths in their families, or have lost their jobs. While studying informatics at the AGH University of Science and Technology in Kraków, Poland, I have been fighting another, seemingly less important battle, but one I passionately feel is vital to our future freedoms. I describe my fight below, so as to encourage and inspire others.
Without serious problems, I completed the fifth semester of my studies. At the beginning of the sixth semester, the pandemic began. Universities closed their physical facilities, so most students returned home and professors started organizing remote classes. Unsurprisingly, they all chose proprietary platforms. Cisco Webex, Microsoft Teams, ClickMeeting, and Skype were popular choices. I could not find a free software client for any of those. Also, not realizing the problem of nonfree js, professors expected everyone to be able to easily join the video sessions using any web interface.
How did I handle these requirements? I would very politely email every single professor who announced something would be done using a problematic platform, explaining the lack of a suitable free software client. I often included a link to a popular online explanation of the issues of software freedom and universities, the “Costumed Heroes” video created by the Free Software Foundation (FSF), along with some other links to free videoconferencing programs like Jami and Jitsi Meet.
Although there are many documented surveillance and security issues on these centralized platforms, I explained that, for me, software freedom was the troubling factor. Replies urging me to “run the program in a virtual machine” or saying that I “don't need the source code to use the service,” made it clear that some of my professors didn't understand, or understood only part of the issues. Had I been studying anything other than informatics, I suspect the fraction of those who understood the problem would be far smaller.
Read more...
by Alexandre Oliva
Picture the most abusive app store.
Programs in it are meant to run on your own computer.
However, you have to be online to run them.
Every time you start them, they contact the app store.
If there is an updated version, it's installed automatically, no questions asked. You'd rather run the earlier version? Tough.
If the app store decides you're no longer welcome, the program won't start any more.
If the app store servers are offline, or if you are, it won't start either. Read more...
Many websites damage users' freedom by sending nonfree JavaScript programs to the user's browser. We invite volunteers to develop free browser extensions to replace for the JavaScript sent by particular sites (see the lists below).
Our first response to the problem of nonfree JS code was to develop LibreJS, which enables Firefox-based browsers to detect and block that code. That protects us from running a site's nonfree JS programs, but does not make the site actually function. Writing an extension for it, as we propose here, would achieve that. It would also avoid the risk inherent in running software straight off someone else's website.
We could also solve the problem by convincing the webmasters to correct their sites to function without the JavaScript code, but convincing them proves to be very difficult, since mostly they don't understand the issue, let alone care about it. Maybe recommending use of these extensions for their sites will convince them to pay attention to supporting non-JavaScript access.
Therefore we invite volunteers to pick a site and write a browser extension to make that site function, assuming that LibreJS blocks the nonfree JavaScript sent by the site.
The first thing to do is to look briefly at the licenses of the JavaScript files on the site. Some of them might actually be free software. If some of the JS code sent by the site is free, you can include it in your extension, changing it as needed.
Next, check whether the site has published an API. If so, it is best to communicate using the API, if that can do the job. Otherwise, you need to use the browser debugging facilities to figure out what data and commands the JavaScript code sends to the server—in effect, its undocumented API.
The way to avoid infringing copyright on the site's own JavaScript code is not to study the code. Not any part of it, not even once. If you did not read the code, it follows that you did not copy any of it. Look only at the licenses.
These extensions should be honest—they should not “cheat.” If the site's JavaScript asks the user for information and sends it, the extension should ask the user for that information and send it. If the site asks per (1) to check a box to agree to XYZ, the extension should ask per to check a box to agree to XYZ. The extension should faithfully pass on whatever responses the user enters. If the site sends a cookie, the extension should let it be handled according to the browser settings for cookies.
It is impossible to implement real security via JS code sent to the user, but whatever the site does to try to implement something resembling security, the extension should carry out faithfully. In particular, if the site asks the user to answer questions to prove perself not to be a robot, the extension should show per the same questions, get the answers, and send them in—thus enabling per to demonstrate that perse is human.
Jeff Carpenter's librecaptcha might be useful if the site sends a captcha. We will start a project to convert it to JS, and we will need volunteers for that, so please write to me if you are interested in helping.
Meanwhile, if the site's JS code gathers information surreptitiously, it is admirable to thwart that snooping. One idea is to ask the user what answer to return—for example, “The site is trying to find out your location. What do you want to tell it?” But it would be good to avoid asking the user frequently or repeatedly.
When you have an extension working, please mail a copy to the GNU Project at <js-extensions@gnu.org>. You can also register it in Firefox's extensions list, if you can stomach running the nonfree software to do that.
We have set up a mailing list, js-extensions-discussion where you can talk with others who are developing extensions.
Once things are going, we would like to set up a savannah.gnu.org repo where we will put the extensions that are working. To do that, we need a volunteer or two to manage it. We expect this task not to be a lot of work; the reason to have two is for redundancy.
We could also have a Savannah project which you could (if you wish) use for developing an extension; that too would require volunteers to take care of it.
Here are some suggestions for sites to write extensions for. However, if some other site interests you more, by all means go where your interests take you. Read more...
New article by Richard Stallman: Should Rockets Have Only Free Software?
Could there be a rocket that is totally free software? Should we demand that SpaceX liberate the software in its satellite launching rockets? I don't think the person who asked me this was serious, but answering that question may illuminate similar issues about the sorts of products people really buy today.
The initial injustice of proprietary software often leads to further injustices: malicious functionalities.
The introduction of unjust techniques in nonfree software, such as backdoors, DRM, tethering and others, has become ever more frequent. Nowadays, it is standard practice.
We at the GNU Project show examples of malware that has been introduced in a wide variety of products and dis-services people use everyday, and of companies that make use of these techniques.
Here are our latest additions:
Malware In Cars
This shows why requiring the user's “consent” is not an adequate basis for protecting digital privacy. The boss can coerce most workers into consenting to almost anything, even probable exposure to contagious disease that can be fatal. Software like this should be illegal and bosses that demand it should be prosecuted for it.
We at the GNU Project love languages. Here are two main things we do in this area and how you can join to help.
Other ways to help GNU
New article by Richard Stallman: https://www.gnu.org/philosophy/saying-no-even-once.html
The GNU Education Team presents examples of teachers, students, parents, free software advocates and the community at large who are taking action to stop the use of nonfree programs in schools and are succeeding. Stay tuned for new cases.
https://www.gnu.org/education/successful-resistance-against-nonfree-software.html
Teachers, students, parents, free software advocates and the community at large are taking action to stop the use of nonfree programs in schools.
The recent health emergency situation caused by COVID-19 presented a new challenge. Traditional in-person classes were suddenly disallowed, and overnight thousands of schools around the world were confronted with a decision to make: either suspend their teaching activities entirely or comply by switching to online classes.
Here is what we can do.
https://www.gnu.org/education/resisting-proprietary-software.html
People know that each GNU package has one or more maintainers
appointed by the GNU Project. People mostly don't know about the
committees that carry out most of the administration of the project.
We have now published a complete description of the administrative
structure of the GNU Project:
https://www.gnu.org/gnu/gnu-structure.html