Wolf480pl
I've said this before but
Software freedom is not when the source code for the program you use is somewhere on github, has 5000 dependencies and doesn't build outside of CI
Software freedom is when you have the source on your computer, modify it, build it, and run a modified version
How much of the software you use on a daily basis would you be able to build from source? How many urls does that require fetching, and how many of these can stop working any time without prior notice?
1/
gentoobro
There are far too many needless dependencies these days. I swear, people have become allergic to actually writing code. It's especially bad in languages with standard or semi-standard package managers. Is a simple wrapper arounf print() too hard for you? Gotta pull in a "logging library" that itself has a few dozen deps. Fucking pad a string? npm install lpad.
The needless deps make everything brittle.
Wolf480pl
I remember my dad's RedHat came on 4 CDs: 2 Binary Discs, one Source Disc and one Documentation Disc.
If it worked the way I think, you could take it to a desert island and rebuild everything from source, with just those 4 CDs and an x86 computer.
Today a Debian mirror has 100+ GB of source packages and 600+ GB of binaries just for amd64.
But at least it's one place, heavily replicated. And IIRC it's supposed to work on a desert island.
2/
Haelwenn /элвэн/ :triskell:
Wolf480pl
@lispi314 @nytpu I think another way to become resilient against link rot is to have all the source code of the packages you use in one place.
There used to be source CDs but most distros don't fit on a CD or a DVD anymore. So either mirrors like Debian does, or keeping the source code of everything you install on your local disk (or a NAS).
A while ago I was of the opinion that Gentoo users are uniquely well prepared for an apocalypse, but that may've changed recently
LisPi
Haelwenn /элвэн/ :triskell:
Haelwenn /элвэн/ :triskell:
@wolf480pl @nytpu @lispi314 That or "woups, backups weren't made properly and we lost part of our infra".
A rogue debian developer would mean at least few lost packages as I doubt most debian developers have enough of a local copy to recover the whole distro.
Wolf480pl
@lanodan @nytpu @lispi314
(assuming by compromise you mean "someone tried to put a backdoor in the source packages")
Wolf480pl
@lanodan @nytpu @lispi314
IIRC (some?) Debian source packages use an upstream source tarball + -debian tarball (containing the debian/ directory, including patches and buildscripts) that gets extracted on top of it, and then patches get applied.
It's not as clean as I would like, but in principle the stuff authored by Debian is separate from upstream code.
You just need pre-compromise build-essential, upsteram tarballs, and audited *-debian tarballs.
Haelwenn /элвэн/ :triskell:
Wolf480pl
@lanodan @nytpu @lispi314
yeah, you typically become a debian downstream instead of forking it
Wolf480pl
@lanodan @nytpu @lispi314
also being a debian downstream distro is one of the sanest ways of doing infrastructure-as-code with Debian
Haelwenn /элвэн/ :triskell:
LisPi
Wolf480pl
@lanodan @nytpu @lispi314
oh, in the sense that it's not a single git repo everyone has - yes, that would be a problem.
I wish they were still doing source CDs :/
Wolf480pl
But also, it's very accessible:
apt-get source -> apt-get builddeps -> make changes -> dpkg-buildpackage -> dpkg -i your-freshly-built.deb
I'm sure many other distros provide a similar solution. Some default to downloading sources as part of building the package, but AFAIK most still require that the actual build doesn't rely on internet.
Can you say the same about your average docker image? Flatpak? Android app? Rust crate? Golang module?
3/
SuperDicq
@wolf480pl@mstdn.io This is one of my main issues I have with Rust actually. Building most Rust software depends on an active internet connection.
SuperDicq
@Pi_rat@freesoftwareextremist.com @wolf480pl@mstdn.io This is indeed the case with many Rust software you download from the internet.
In order to fix this you have to manually edit your .cargo/config to explicitly say to use your local version of the library (or "crate" as rust calls them, ugh) instead of the one from the internet.
For example Debian has patched all the Rust software available in their repository to be buildable offline in this way, as Debian does not allow software that can not be built without an internet connection.
It is described here: https://wiki.debian.org/Rust
Pi_rat
SuperDicq
@Pi_rat@freesoftwareextremist.com @wolf480pl@mstdn.io it was not completely source available even.Wait what?
Pi_rat
SuperDicq
@Pi_rat@freesoftwareextremist.com @wolf480pl@mstdn.io @Suiseiseki@freesoftwareextremist.com I don't think that's true?
Pi_rat
翠星石
Pi_rat
r
SuperDicq
@Suiseiseki@freesoftwareextremist.com @Pi_rat@freesoftwareextremist.com @r@freesoftwareextremist.com @wolf480pl@mstdn.io Yeah that's exactly how I thought Rust worked. It doesn't require blobs and is not nonfree, but bootstrapping Rust is a lot more complicated than it has to be, especially when compared to GNU C.
翠星石
SuperDicq
@Suiseiseki@freesoftwareextremist.com @r@freesoftwareextremist.com @wolf480pl@mstdn.io @Pi_rat@freesoftwareextremist.com The amount of code to check is always unreasonable, this is also the case in GCC. Nobody is going to manually read the entire codebase of GCC from front to back before using it.
I mean I probably trust the maintainers of GCC enough that they would never implement proprietary blobs into their compiler's source tree and that is good enough for me to call it free software, unless someone proves. Same can be said for Rustc I think.
翠星石
GNU social JP is a social network, courtesy of GNU social JP管理人. It runs on GNU social, version 2.0.2-dev, available under the GNU Affero General Public License.
All GNU social JP content and data are available under the Creative Commons Attribution 3.0 license.