Caretaker of DS8.ZONE. Free (Libre) Software enthusiast and promoter. Pronouns: any

Also /u/CaptainBeyondDS8 on reddit and CaptainBeyond on libera.chat.

  • 0 Posts
  • 23 Comments
Joined 4 years ago
cake
Cake day: March 27th, 2021

help-circle
  • I feel like there’s a lot of FUD around this subject, because people bring it up as if it’s purely a negative without talking about the reasons why it’s done the way it is. The whole point of F-Droid is that it’s a repository (not a store) of free software applications. They have an inclusion policy forbidding proprietary code and dependencies, and in order to enforce this policy they have to build from publicly available source code, and in order to do so they need to sign the builds themselves. This means, yes, you are trusting F-Droid instead of the upstream developer - but given F-Droid has higher standards than upstream developers this is a tradeoff I am willing to make.

    Reproducible builds solves this in a way that preserves the standards of F-Droid, however, “security peoples’” favored “alternatives” (such as Accrescent, Obtainium, and Google Play Store/Aurora Store) forego this entirely, showing they don’t either have a viable solution to offer or that they don’t really care about the problem that F-Droid is addressing to begin with.











  • I guess I’m being called out here, so wall of text incoming.

    Linux and GNU are completely separate projects that have no relationship organizationally or technologically. As basic as this is, this is important to understand as the backdrop for “the GNU/Linux issue.”

    Linux was started in 1991 as a project to build an operating system, one that is “not as big or professional as GNU.” In practical terms, Linux is just a kernel. It has no terminal, no command line tools, no desktop, no package manager, no web browser. Yet, people speak of it as if it’s a fully featured operating system that contains all of those things, an alternative to Windows or macOS.

    GNU was started in 1983 as a project to build an operating system, but as GNU’s own kernel (the Hurd) is in development hell, the userland components (libraries and tools) are generally used with Linux to form a complete operating system, which is referred to as GNU/Linux. The “slash” is meant to signify that it’s a combination of these two projects. Note that, as the GNU project has adopted the Linux-libre variant of Linux, the Hurd is no longer really a priority project.

    Of course, you can have Linux without GNU (Android and Alpine are the best examples of this) and you can also run GNU on non-Linux platforms (Debian has a port that runs on the FreeBSD kernel, and the tools themselves run on any Unixy operating system and even Windows). So I don’t really think you can conclude any of these are the “most important part” of the operating system, and it more or less comes down to whatever brand name you feel the most comfortable with.

    And, of course, most GNU/Linux operating systems contain much more than GNU and Linux these days. Therefore, I prefer to understand Linux as a family of operating systems (as Wikipedia defines it) and GNU/Linux as a subfamily. The ironic thing is that, from a UX perspective, Linux, the kernel, is probably the least prominent component of the operating system, as it is furthest away from the user interface - but it is most prominent brand name and so gets applied to the whole “ecosystem.”

    A lot of Linux fans think an operating system has to have more than Linux to be a “real Linux” operating system, or that it has to be community run or “anti-corporate” or meet some ideological criteria. But, Linus himself has no such ideology, and Linux is a very corporate project. Android is the most widely used Linux operating system. It is as much “real Linux” as Debian is.

    The myth of the fictional operating system called Linux naturally leads to other myths, such as the myth of fragmentation. In that sense I feel it’s harmful, but the damage has been done and even the conversation around the myth has its own myths (such as the idea that Stallman wants to “rename Linux” or is jealous of Linux’s popularity, that “Linux should be called GNU/Linux” because “it contains GNU” or because it was built with GNU tools or licensed under the GPL). It’s hard to argue for “calling it GNU/Linux” when people don’t even understand what “it” is, or even what the admittedly convoluted name is supposed to signify. So, for that reason, I don’t think the “battle” is worth fighting anymore.

    For the record, though, I refer to my preferred operating system by its own name, GNU Guix System, and make an effort not to center any particular project or brand name when talking about the free software community and ecosystem in general. I don’t characterize myself as a fan or user of Linux, just a free software enthusiast - the fact that all of my preferred operating systems contain Linux is a consequence of the fact that Linux is the most widely used free software kernel, not because of any brand loyalty on my part. Non-Linux operating systems such as the BSD’s should be considered as part of the free operating system family.


  • FOSS/privacy community

    These are not the same community. The actual free software community has been a thing for 40 years, and the privacy/security people spend as much time attacking free software as they do big tech. I’ve come to believe no security or privacy guy is trustworthy in the free software space. Reject Rossman, return to Stallman.

    edit: security guys will say “free software isn’t always more secure!” and privacy guys will say “freedom, what is this freedom? it has no internet access, that’s the only thing that matters!” and meanwhile stuff like WEI is being implemented, that we’ve been warning about for the last 40 years. The security and privacy guys will say you don’t need freedom, just the “best tool for the job” - Chrome was the best browser when it came out, now it’s being used to subjugate the free web. WEI is the end result of treating freedom as a second thought behind security.







  • The reason F-Droid builds from source is to ensure that they can enforce their inclusion criteria. If you go outside F-Droid you lose that guarantee. For example, self-published apks in github or google play may contain anti-features or proprietary code that are forbidden by the F-Droid standards.

    From another point of view, what you call a single point of failure is a third party that represents the interests of the user community, independent from individual developers. This is the same model used in GNU/Linux distributions, and Drew DeVault explains here the role that software distributions play in the free software community.

    Of course, this represents a trade-off, in that you are placing trust in the software distribution instead of or in addition to the upstream developer. The question is, how can you solve the problem without foregoing F-Droid’s inclusion standards? The answer is reproducible builds, where F-Droid builds from source and compares to the developer’s apk, and publishes the developer’s apk with their signature if the build reproduces successfully.

    Until Reproducible builds are the norm in the Android free software world, I accept the trade-off because I value having software freedom in my computing, and I know I can’t trust upstream developers to care about that as much as F-Droid or I do.