[Arm-netbook] Free distribution certification (was Re: eoma68-jz4775 x-ray pictures)

Fri Apr 29 18:59:37 BST 2016

Hi,

2016-04-29 15:03 Paul Boddie:
>On Friday 29. April 2016 15.21.12 Luke Kenneth Casson Leighton wrote:
>>
>> > Since the alternatives that FSF recommend and bless are something like
>> > Trisquel or gNewSense, which are based on Debian (or Ubuntu?),
>>
>>  trisquel's based on ubuntu 8.04, and hasn't moved since.  gNewSense
>> is debian, and they appear to have used debian, but went for a much
>> more comprehensive "rebranding".  i'm interested in doing the minimum
>> required amount of work here.
>
>I think it's easy to go round in circles here when the FSF's own guidelines
>can instruct us and help explain why these separately-branded distributions
>exist. I hope the FSF doesn't mind me quoting from their document. ;-)

I know the reasons, but I don't agree with them and think that they are
misguided and actively harmful in this area.

Which is a shame, because in general I align 100% with the principles of
the FSF, as many other people in Debian do.

( Yes, I know that this is futile to resolve here, just wanted to refute
  some of Luke's points about being difficult to install non-free
  software in FSF-certified distros.

  BTW, I forgot to say that apt-1.1 and gdebi both install and resolve
  dependencies of local files, so they're even more convenient to use
  than dpkg for this purpose.  Probably package-kit-based front-ends and
  other higher level tools used from desktops --which I am pretty sure
  that are also present in Trisquel and gNewSense-- make the process
  easy as well ).

>On branding and naming:
>
>"We will not list a distribution whose name makes confusion with nonfree
>distributions likely. For example, if Foobar Light is a free distribution and
>Foobar is a nonfree distribution, we will not list Foobar Light."
>
>http://www.gnu.org/distros/free-system-distribution-guidelines.html#name-
>confusion
>
>So, if Debian is "nonfree" (let us not get into why or how they might reach
>that conclusion), then you won't get a Debian-branded certified distro.

This is FSF's objection about Debian:

  ============================================
  http://www.gnu.org/distros/common-distros.html

  (3 paragraphs)

  #1: "Debian's Social Contract states the goal of making Debian
  entirely free software, and Debian conscientiously keeps nonfree
  software out of the official Debian system. However, Debian also
  provides a repository of nonfree software. According to the project,
  this software is “not part of the Debian system,” but the repository
  is hosted on many of the project's main servers, and people can
  readily find these nonfree packages by browsing Debian's online
  package database and its wiki."
  ============================================

(Funnily enough, many "non-free packages" in non-free is documentation
for GNU software.  I am very happy that we host those in Debian, even if
they are "non-free", and I believe that it's a good service for Debian
users.)

Repository names, URLs and the section to which the packages belong
(shown in many tools) are clearly labeled as "non-free".  Any person who
wants to be careful installing such packages has enough hints to
indicate that s/he's installing something "non-free" because of some
specific aspect, and study it carefully (which still, its not being a
full "app store" full of proprietary apps, in any case).

Considering that these are not enough warnings is IMO condescending
towards those users, be them "grandma" (condescending and disrespectful
term for old women, BTW), 7 year-olds, or tech users.  And it's not true
that it's more challenging for any user, tech-savvy or not, to
enable/install non-free software in Trisquel or gNewSense *compared to*
Debian.

Besides, there are many opportunities outside the package system to
install non-free software, e.g. plug-ins for many applications.  I don't
think that in Trisquel/gNewSense most of those cases are either
prevented by the applications or that the users get a big warning if
they try to install plugins, or that they don't work if they follow the
documentation provided with the package and shipped in the distro, or
recommended in their own forums (4th post):

https://trisquel.info/en/forum/say-goodbye-npapi

Whether they are hosted or not by the distribution is not very important
in the end, end-users don't even know where they come from (esp. if URL
is not visible).  Maybe they assume that plugins for all the tools come
from the distro, when in fact they don't, which is *worse* than when
they decide to install a package on the system coming from controlled
repositories such as Debian's (even if it's the "non-free" one).

To make matters worse, in 2016 it is perfectly possible to use the
browser or a messaging program to use with non-free services, many
selling your data; play non-free-games; emulate DOS or MAME machines
within the browser; or or visit websites with non-free JS; or many other
problems that FSF is rightly concerned about.  The distro is not the
biggest channel through which these "dangers" come, but the network,
which is the same for all distros.

So I think the position of the FSF is hypocritical in this respect, but
specially shortsighted / outdated / ineffective, and focusing on trivia
while ignoring big and relevant problems.

  ============================================
  #2: "There is also a “contrib” repository; its packages are free, but
  some of them exist to load separately distributed proprietary
  programs. This too is not thoroughly separated from the main Debian
  distribution."
  ============================================

RMS famously believes that it's not crucial if games have non-free data,
and one of the links that you post below says:

  "It does not include artistic works that have an aesthetic (rather
  than functional) purpose, or statements of opinion or judgment".

Well, this is one of the cases for "contrib": if the game engine is free
but requires non-free data, goes to "contrib"; if it can be used with
fully-free data goes to the "main" archive.

  ============================================
  #3: "Previous releases of Debian included nonfree blobs with Linux,
  the kernel. With the release of Debian 6.0 (“squeeze”) in February
  2011, these blobs have been moved out of the main distribution to
  separate packages in the nonfree repository. However, the problem
  partly remains: the installer in some cases recommends these nonfree
  firmware files for the peripherals on the machine."
  ============================================

Since the users are warned about the non-freeness of the firmware, they
can make their own choice.  In some cases the firmware is necessary for
their machines to work correctly (incl. updates to the microcode of the
processor, unfortunately), in other cases they can opt-out of using the
firmware and using a wifi-dongle instead which operates without or with
free firmware, for example.

In the majority of cases, users (tech-savvy or not) are better off if
the updates to such carefully controlled and very limited set of
packages come through Debian than if they have to chase them up around
the net from multiple vendors and websites.

But in any case, the warnings are there, so the FSF position on this is
unnecessarily condescending.

And given that GNU started off and still actively supports their
packages working on non-free systems, I cannot see what's the
fundamental difference by which is bad for Debian to enable the use of
free software in non-free hardware but good for GNU to support Solaris
or Windows, for example, and create proprietary executables and enable
other non-free software, and continue/extend its use by virtue of the
network effects.  The reason for LGPL it's "strategic", in the case of
Debian doing the same is bad.  Hum, double standards.

>On using non-free software:
>
>"What would be unacceptable is for the documentation to give people
>instructions for installing a nonfree program on the system, or mention
>conveniences they might gain by doing so."
>
>http://www.gnu.org/distros/free-system-distribution-
>guidelines.html#documentation
>
>So, again, the problem might be that since Debian documentation, such as the
>Debian Wiki which bears an increasing amount of responsibility for documenting
>the distribution, mentions how to install non-free software, this might count
>against Debian itself being regarded as a certified distro. They do mention
>this, though:
>
>"For a borderline case, a clear and serious exhortation not to use the nonfree
>program would move it to the acceptable side of the line."
>
>I guess this would require editorial practices not currently undertaken plus
>some discipline from people contributing to the documentation.

I think that it would be much more easy/productive to go and edit the
Debian wiki in those cases than create full distributions, and that the
Debian people would even be grateful.

Otherwise, I don't follow every corner of the wiki, but there are many
cases already with the big warnings:

  https://wiki.debian.org/skype

Compare with (not the only one):

  https://www.fsf.org/working-together/gang

"Software for viewing YouTube videos" (non-free service), "Java" (with
some bits of the stack problematic for many years, I don't know lately),
or Mozilla which allows non-free add-ons and codecs, and the page
(sanctioned by FSF staff, not even volunteers) without any warning at
all that these can harm your freedom.

>On providing non-free software:
>
>"The system should have no repositories for nonfree software and no specific
>recipes for installation of particular nonfree programs."
>
>http://www.gnu.org/distros/free-system-distribution-guidelines.html#license-
>rules
>
>This is the big obstacle. I suppose Trisquel and gNewSense get around this by
>hosting their own repositories and not hosting the non-free ones.

Which is probably ineffective with the case of program's plugins, for
example; and it glosses over the fact that users sometimes will be
forced to find their way to install what they need with very suboptimal
consequences because the whole computer will not work otherwise.

BTW, the FSF recommend F-Droid (of which I am very happy user and
donator) even if they contain many apps that can solely be used with
non-free services (e.g. Telegram) and are not separated in different
repos or are not difficult to enable:

  http://www.fsf.org/working-together/next-steps/free-software-for-android

  https://www.fsf.org/blogs/licensing/android-market-has-drm-too

or an interview, without asking/mentioning anything about non-free
services:

  https://www.fsf.org/blogs/licensing/interview-with-ciaran-gultnieks-of-f-droid

So I don't understand why it's more problematic to enable non-free for
firmware that your processor needs to operate, or non-free data for a
game, than to install a program that can only be used to access non-free
services or share your data.

>I can understand why the FSF wants to help users avoid the slippery slope of
>doing what random people on the Internet suggest, enabling various
>repositories for a quick fix when some proprietary service doesn't work, and
>then seeing those people fill their systems with dubious and potentially
>stability-damaging software, not to mention that it would be non-free and
>could have negative effects on their freedoms and, through network effects, on
>others' freedoms.

I agree, and that's exactly one of the things that Debian non-free repos
achieve: to have a central place where key pieces that many people will
need with today's state of hardware and things, and which is in general
much safer than any other 3rd party repos.

If the users installing Trisquel or gNewSense need those non-free bits
for any reason, they would be better off from any point of view if they
enable the non-free repos provided by Debian (or if they had installed
Debian in the first place).  The alternative, which is to go to
Intel's/nvidia/broadcom/whatever website, is much worse in most cases.

>The result might be that if anyone does try and pitch a certified distro, it
>ends up being a small one that doesn't offer the breadth of something like
>Debian because of the magnitude of the diversion from whatever goal the people
>doing it originally had. In this case, how much effort should be diverted away
>from getting the hardware and software done towards rebranding, repacking and
>hosting something that is essentially Debian?

My reply to this question is clear: acknowledging that the information
and separation in Debian is enough, move on, and try to spend the
energies in solving the real problems, e.g. supporting free hardware
initiatives :)

Since things like de-blobbing the kernel (as Phil pointed out) come from
Debian people, the existence of Debian is a great positive for
free-software-loving users, and the only reason why derivatives as those
blessed by FSF can even exist.

So I always find this hostility towards Debian very unnecessary and
annoying (as it can be gauged by the length of my reply :P).

>I really think that the different parties should just get together and develop
>a reasonable understanding around these matters based on the substantial level
>of agreement they probably already have.

There are people trying actively to resolve this, and John Sullivan
(exec director) is a Debian Developer and participated in the last 2
DebConfs with talks related with this.

But I feel that the historical decisions that made them not recommend
Debian are holding them in the same position, while they obviate the
same problems when applied to new things like F-Droid and the same
practical problems with Trisquel and gNewSense, or their own software
packages.

Cheers.
-- 
Manuel A. Fernandez Montecelo <manuel.montezelo at gmail.com>