@toatrika@plasmatrap.com@Starkimarm@23.social but it seems like your argument is entirely predicated on proprietary apps being a bad thing and therefore every proprietary app must be suceptible to every bad thing any other proprietary app has done before without requiring further examinationThis is exactly my argument. If proprietary software is not already malware, it will always become that over long enough time as the developers get more greedy. It always happens, no exceptions.
@SuperDicq@toatrika@Starkimarm It dependents on FCM (only used for waking system and not for sending actual notification). You can still use Molly, a Signal fork which doesn't dependent on FCM.
@SuperDicq@toatrika@Starkimarm "If it's not in F-droid, it's proprietary." What kinda stupid logic is that? In that sense, @GrapheneOS apps would also proprietary just because they decided against publishing it on F-droid
@SuperDicq@toatrika@Starkimarm@tris F-Droid isn't a good or safe way to get open source apps. It adds another group of people as a trusted party who have demonstrated disregard for basic security and user safety. There are a huge number of high quality open source apps not available in F-Droid and many developers don't want their apps packaged there. Apps not being included in F-Droid's main repository doesn't mean they aren't fully open source. Molly has a fully open source variant.
A lot of your requirements are literally "who cares?", the user gains nothing from so called safety features if they are implemented in a mostly proprietary system it.
I know a fully free software smartphone isn't possible mostly due to modem firmware, but outside of that most things can be free.
Why doesn't GrapheneOS have a minimum requirement when it comes to stuff like this at all?
I prefer the hardware supports decisions from projects like Replicant a lot more, where they try to minimize nonfree blobs as much as possible (including down to the boot firmware on some devices)
@SuperDicq@toatrika@Starkimarm@tris There are zero devices providing what existed for Pixels prior to Android 16 and no longer does. Not clear what you think we were talking about in posts but it wasn't something which exists for anything else. We're in talks with OEMs about meeting these requirements like Pixels which is going well. We'll be just fine.
F-Droid wouldn't run on a single device if it didn't run on top of closed source hardware and firmware. What's your point supposed to be?
@SuperDicq@toatrika@Starkimarm@tris GrapheneOS doesn't have any partnership with Google. Pixels remain the only devices meeting our very reasonable hardware security requirements listed at https://grapheneos.org/faq#future-devices. We finished our port to Android 16 days ago and are well into the work required to release it for the devices we support. You don't have an understanding of what we do or what we posted about.
F-Droid is an Android app for OSes on Android hardware. You realize that, right?
Software freedom is absolute and measurable (something either gives you the four freedoms or it doesn't).
Security however, is highly subjective and completely depends on your usecase and attack vector.
In my opinion, a lot "security focused" software that doesn't focus on freedom first, like GrapheneOS, is mostly supported by overpriced security consultants who like LARPing about hypothetical and unreasonable schizophrenic attack vectors that nobody in the real world should actually care about.
@SuperDicq@GrapheneOS@toatrika@Starkimarm@tris As a GrapheneOS user for the past year, I actually agree with this post. I was introduced to GrapheneOS by someone I know only for them to actually switch to something later while I've been locked into buying a Pixel phone and trying this whole privacy OS about only to learn that there's actually other Privacy OSes that can run on a multitude of devices that isn't google pixel and I could even run more things on it than what I could on Graphene.
I too have a Pinephone that I was using and I wonder why can't something like that have GrapheneOS on it? Though I understand if it's because the battery life is absolutely trash on the Pinephone, But many other phones could be used. It's weird that it is just Google and how they have some sort of thing that makes it more important than others in terms of Security. Like dude, I'm already downloading APK files to install on my phone what's the issue with other phones for "Security"? I'm using Proprietary Google hardware over here, How can I exactly trust it?
Like sure, you are protected from these USB attacks that require hardware access. But all that stuff really doesn't matter when you're running Google or Apple services or other proprietary apps that store all your personal data in their "cloud".
Make it make sense and focus on the low hanging fruit first, by only allowing free software.
> the user gains nothing from so called safety features if they are implemented in a mostly proprietary system it.
Our requirements are needed to provide strong privacy and security including protecting people from widely available commercial exploit tools. See https://discuss.grapheneos.org/d/14344-cellebrite-premium-july-2024-documentation for an example. As one example, the Pixel 6 and later / iPhone 12 and later are the only devices providing a secure element successfully blocking brute force attacks.
@SuperDicq@toatrika@Starkimarm@tris GrapheneOS doesn't come with any services storing user data in the cloud. Our users prefer end-to-end encrypted services and privacy focused apps. People can choose what they want to run and it's our job to protect their privacy/security.
Apps installed on GrapheneOS are sandboxed with a significantly improved version of the standard Android app sandbox with a better permission model. Storage Scopes, Contact Scopes, Sensors toggle and much more are added.
@GrapheneOS@grapheneos.social@toatrika@plasmatrap.com@Starkimarm@23.social@tris@chaos.social Any ARM SoC has immensely complex closed source hardware/firmware for the CPU, GPU, memory controller and the rest of what's provided.That's just not true. There's many ARM SoCs that require none or a very minimal amount of proprietary blobs (often just for booting or memory training and nothing else after that).
> I know a fully free software smartphone isn't possible mostly due to modem firmware, but outside of that most things can be free.
Hardware and firmware is closed source in general. Any ARM SoC has immensely complex closed source hardware/firmware for the CPU, GPU, memory controller and the rest of what's provided. There is no ARM SoC that's open. There is no serious RISC-V SoC alternative and most RISC-V chips are largely or fully closed source too.
@SuperDicq@toatrika@Starkimarm@tris We do not require having a secure element on the same level as the Titan M2. Our requirements do not require a device to be on the same level of security as what we have now. We only require that the basic features we use are present. Everything on our list of requirements is very reasonable and industry standard. OEMs we're in contact with are confident they can provide everything we require. There's nothing exotic listed as a requirement there.
@SuperDicq@toatrika@Starkimarm@tris There are some basic RISC-V CPU core designs which are open but using those wouldn't result in an open source SoC. Then you have all of the other components: Wi-Fi, Bluetooth, cellular, NFC, GNSS and optionally UWB each have a closed source SoC with closed source firmware. It's a common misconception that cellular is special in this regard. In general, these radios are their own little computer isolated from the main processor on mainstream devices.
Also consider this; If the firmware on the chip is proprietary anyways, meaning it can't be properly studied, audited or patched, why do you consider it a good thing to load the blobs from the OS?
Wouldn't it be better to just leave it as it is, so at least you know it's not going to change?
Wouldn't that also allow new previously unknown issues to arise if you keep updating it with the latest available proprietary blobs?
@SuperDicq@toatrika@Starkimarm@tris Using ancient devices without firmware / driver patches with an ancient fork of Android without security patches guarantees having extreme lack of privacy and security. It's the direct opposite of what we want. The hardware and firmware underneath is in fact no more open source. The requirement of not having to load firmware from the OS is extremely arbitrary and is in fact less transparent than unobfuscated firmware which must be loaded by the OS at boot.
> I prefer the hardware supports decisions from projects like Replicant a lot more, where they try to minimize nonfree blobs as much as possible (including down to the boot firmware on some devices)
This isn't true. Replicant and Purism use closed source hardware and firmware. Their requirement is that the OS doesn't have to load the firmware at boot so they can pretend it's not there. Almost none of the overall firmware on those devices is open.
@GrapheneOS@grapheneos.social@toatrika@plasmatrap.com@Starkimarm@23.social@tris@chaos.social Closed source hardware and closed source firmware don't stop existing if you don't have to load the firmware from the OS at boot.Yes I think it will. When enough projects (and that includes GrapheneOS) say enough is enough and actively stop including proprietary firmware, you can actually force OEMs to start releasing the firmware under a free license.
@SuperDicq@toatrika@Starkimarm@tris Closed source hardware and closed source firmware don't stop existing if you don't have to load the firmware from the OS at boot. It doesn't matter any less. The operating system not being able to update firmware is a loss of important functionality needed to patch security vulnerabilities, not an improvement. Pinephone is full of closed source firmware which can be updated anyway, although it's largely not maintained with proper security updates.
@GrapheneOS@grapheneos.social@toatrika@plasmatrap.com@Starkimarm@23.social@tris@chaos.social hiding the security flaws which are left unpatched by removing warnings from the Linux kernel and elsewhere is not helping, protecting or giving users freedom.I'm not that familiar with the smartphone world, but as far as real computers are concerned I know Linux-Libre and GNU Boot developers are not simply hiding warnings from the kernel, they are actively developing workarounds inside the kernel that fix these issues without installing proprietary blobs from the OEM.
@SuperDicq@toatrika@Starkimarm@tris You seem to be confusing the Pinephone with the Librem 5 which chooses components based on them being able to block updating the closed source firmware. That assures insecurity. Taking away the option to update firmware is hardly giving users freedom. Not letting users update microcode/firmware and hiding the security flaws which are left unpatched by removing warnings from the Linux kernel and elsewhere is not helping, protecting or giving users freedom.
@GrapheneOS@grapheneos.social@toatrika@plasmatrap.com@Starkimarm@23.social@tris@chaos.social Firmware or software being closed source doesn't imply it can't be audited and reviewed. Everything is possible to reverse engineer and decompile with enough time and effort, but you lack the same tools (the actual source code) that the developer at the OEM used they are at a massive advantage over you. And they will abuse that advantage for profit, control and power.
@SuperDicq@toatrika@Starkimarm@tris Hardware which does not have most of the firmware baked in but rather requires to load it from the OS is more open to inspection. Firmware or software being closed source doesn't imply it can't be audited and reviewed. It doesn't imply that it's obfuscated. Closed source hardware and firmware which you ignore and don't update doesn't make it go away and just assures insecurity and lack of privacy via having serious unpatched vulnerabilities known for years.
@SuperDicq@toatrika@Starkimarm@tris No, you're completely wrong about this. You're continuing to inaccurately conflate not needing to load firmware/microcode from the OS or updates to it not being available as it not existing. It doesn't stop existing just because there aren't updates for it or the OS doesn't have to load it. Pinephone SoC is entirely closed source hardware and low-level microcode/firmware. Late stage boot chain after the early boot firmware being open doesn't make it open.
I and many other people who actually care about not being enslaved have different priorities.
First you give me control over my own device, absolute 100% software freedom. And only then when software freedom has been achieved we can start talking about fixing mundane issues like improving security.
@SuperDicq@toatrika@Starkimarm@tris There are 0 devices we could support without closed source firmware. Not loading microcode/firmware from the OS and leaving users vulnerable to unpatched vulnerabilities isn't acceptable to an actual privacy/security project.
Open source also doesn't have the magical privacy and security properties you believe it does. It doesn't make things inherently private/secure and doesn't provide mean all the vulnerabilities can be found even with huge efforts.
It's a subset of the security issues being fixed for the Linux kernel and that's a subset of what's being publicly discovered for it.
Does it being open source, immensely widely used and widely reviewed/tested somehow prevent or result in these vulnerabilities all being quickly discovered? No. Many are years old.
@SuperDicq@toatrika@Starkimarm@tris Desktop and laptop computers are similarly closed source hardware with closed source firmware. The linux-libre project primarily exists to remove support for firmware updates which are usually needed to patch vulnerabilities. They aren't replacing the security patches with anything. They're removing the ability to apply those updates and are removing warnings about having outdated CPU microcode and other firmware. They do exactly what you say they aren't.
@SuperDicq@toatrika@Starkimarm@tris Your description of freedom is thoroughly convoluted and nonsensical. You claim that if the software is hard-wired into the hardware and cannot be updated, it doesn't matter. Hard-wiring the operating system in a way that it cannot be updated would comply with your description of software freedom. It's utter nonsense. It's a bunch of semantic games to try to justify only focusing on software and drawing an arbitrary line where it doesn't matter anymore.
Nobody in their right mind considers these devices nonfree or "closed source". They software that runs on them is literally part of the hardware, it doesn't create any unjustice. It just exists and just sits there, never being updated. Stopping users updating or replacing software/firmware is in fact removing freedom.Users can't update or replace proprietary firmware, we're not taking this freedom away. The OEM is the one taking this freedom away, because they are the only ones that have the source code and the legal rights to modify it.
But if the software is on a ROM chip, neither the OEM nor user can modify the software anymore. It's not ideal from a technical standpoint but now at least the OEM and user are equals, there is no unjustice in this scenario.
@SuperDicq@toatrika@Starkimarm@tris What you've claimed is that closed source matters if it can be updated, and that if it's hard-wired into the hardware then it doesn't count anymore. The whole software on a device can be hard-wired with no updates possible. That complies with your completely nonsensical idea of software freedom. The reality is that the arbitrary line you're drawing is completely illogical. Stopping users updating or replacing software/firmware is in fact removing freedom.
@SuperDicq@toatrika@Starkimarm@tris A small group of illogical people who don't actually care about freedom, privacy or security but rather pay lip service to them disagrees with it. We're well aware of where you're getting these nonsensical ideas from and appealing to the authority of RMS doesn't give your arguments any weight.
@GrapheneOS@grapheneos.social@lxo@snac.lx.oliva.nom.br I do not wish to promote software that is not fully free. I mostly just mentioned it as an example of something that is slightly less bad than mobile operating systems that contain a lot of proprietary software and do not try to minimize it much as possible.
The only think I can recommend in good consciousness however is to not own a smartphone at all, as no fully free smartphone currently exists.
@SuperDicq@lxo Earlier, you promoted a closed source cellular baseband by inaccurately claiming that the radio firmware can be mostly replaced with open source software, when in fact none of the radio firmware can be replaced. It's quite strange to present yourself as an advocate for open source software/firmware/hardware when you're marketing closed source hardware/firmware including presenting it as having an open source firmware replacement it in fact does not have available in any way.
@SuperDicq@lxo What we said is completely accurate. Pretending firmware doesn't exist and not updating it doesn't make it not exist. Pretending hardware isn't closed source doesn't make it open. Every ARM SoC is closed source hardware/firmware even if it doesn't support any firmware updates, has none released or the OS chooses not to apply them.
Disabling doing firmware updates for closed source firmware that's still present is not making it open. It's convoluted and nonsensical reasoning.
@tris@chaos.social Telegram has many free software clients available for it, most of them are released under the GPLv3.
I own a few smartphones, but I am well aware none of them are perfect from a software freedom standpoint and I wish they were more free. This is also the reason why I am not dependent on any of my smartphones and I don't need them to live out my daily regular life.
My current list of smartphones if you're curious: Samsung Galaxy S2 with Replicant Pinephone running Mobian Fairphone 3 running LineageOS
@SuperDicq@GrapheneOS@toatrika@Starkimarm You're comparing watch and microwave oven to smartphones now? May I know since when Telegram became free software and also what smarphone are using and OS running on it?
@SuperDicq@lxo You promote is closed source hardware, firmware and software as long as you don't have the ability to update it. You're promoting closed source hardware/firmware like the Pinephone which doesn't even meet what you see as a valid loophole where blocking firmware updates means it doesn't count as closed source.
You claim that closed source hardware, firmware and software is free if it cannot be updated by anyone. That has no connection to what we want. It's just nonsensical.
but part of the reason why you two are talking past each other is that one of you speaks in terms of open/closed, while the other speaks of free software. the former lacks (because it was designed to remove) the ethical principles that are the foundation of free software.
when software is embedded in hardware in a way that one can't tell whether it's hardware or software without opening the hardware black box, there's no ethical difference between depriving users of software source code or of hardware specifications: the software becomes part of the hardware, and for hardware, even the practical freedoms are more limited: copying and adapting hardware are by nature a lot easier for software.
so, whether or not you consider proprietary hardware unethical, this ethical equivalence between hardware and software equivalent to a hardware circuit embedded in it makes it a lesser offense (if an offense at all) than that of the more general case of nonfree software.
@GrapheneOS@grapheneos.social@lxo@snac.lx.oliva.nom.br At least projects like Replicant, Pinephone or Librem are trying their best to reduce the amount of proprietary software as much as possible. That's literally all I can say about it.
Something GrapheneOS is not doing, as it thinks including as much proprietary software as possible is a good thing actually because it might fix a few security issues.
@lxo@SuperDicq@toatrika@Starkimarm@tris Your movement does not have a monopoly on caring about ethics around software. What you have is a monopoly on building up a huge mountain of cognitive dissonance around it for decades. Rational people who have not been pulled into it can see how ridiculous it is to claim that blocking replacing or updating software/firmware creates a freedom respecting device. No amount of rhetorical games and essays will make what you push rational or ethical.
@lxo@SuperDicq@toatrika@Starkimarm@tris You don't care about freedom. You want conformance to a nonsensical framework you've come up with where somehow a locked down device where the user can't replace anything is what you consider freedom. You don't want people making informed choices. You go out of the way to try to hide that people are missing patches for severe security issues. You in fact don't want people to have the freedom to apply those updates. You don't want an informed choice.
@lxo@SuperDicq@toatrika@Starkimarm@tris You're trying to justify highly illogical and nonsensical beliefs you hold with convoluted nonsense. That is your whole ideology. It's just playing a bunch of rhetorical games. You folks claim a device that's completely locked down with no updates is free vs. a device where you can replace major parts of it being non-free if there's a closed source firmware component which can be updated. Most people find it to be ridiculous nonsense, not only us.
@GrapheneOS@lxo@SuperDicq@toatrika@Starkimarm@tris this is an up and coming attack on free software for the last couple years, that users are more free based on utility than fundamentals like do you really own your device or does the vendor keep secrets on it from you or artificially limit modification. by this logic adobe photoshop is more free software than gimp.
@SuperDicq@GrapheneOS@toatrika@Starkimarm@lxo@tris I agree and disagree with them and you on different things but basically all closed firmware and software is a boot on your neck so even if you have legitimate reasons to run it it's not "free". the metaphor gilded cage exists for a reason
@SuperDicq@toatrika@Starkimarm@sun@lxo@tris Not loading or updating closed source firmware via the OS doesn't make it stop existing. Leaving yourself and more importantly others vulnerable to serious known vulnerabilities is not trying to provide privacy and security. Misleading people about them, hiding it from them and putting them at risk is highly ethical. You don't want people to make informed decisions. You want to eliminate choices and force people to have insecure devices.
It is you falsely claiming closed source hardware and closed source firmware is open source when it isn't. Pinephones are closed source hardware and firmware. Misrepresenting replacing a weird extra OS on an extra CPU next to the baseband as being open source baseband is a particular egregious form of false marketing by their company and supporters.
@SuperDicq@toatrika@Starkimarm@sun@lxo@tris That is what your "libre" projects do. They mislead people, hide important information from them and leave them vulnerable. They're thoroughly unethical. You're willing to do unethical things to advance something that's not at all a coherent ideology about freedom but rather a tunnel vision focus on only software. That includes attacking us with false claims, attacking our team, misrepresenting our statements and the rest of what you folks do.
@SuperDicq@toatrika@Starkimarm@sun@lxo@tris It's little different from Jehovah's Witnesses or Mormons showing up at our door to proselytize while being incapable of understanding we do not see their beliefs as rational.
@SuperDicq@GrapheneOS@toatrika@Starkimarm@lxo@tris if you use free software as a major component of your software you benefited from the ideological extremist position of groups like the FSF, whether you like it or not you live in the world that software extremism created.
@tris@Starkimarm@GrapheneOS@SuperDicq@toatrika@lxo they're doing it for selfish reasons and submit their changes back to the world out of obligation, it's nice when that works and I don't have to support big tech yet benefit from their code contributions. yet it's unclear if this will continue in the future since companies are excising free software and coopting projects covertly in various ways. I think it's telling that companies like google avoid AGPL like a vampire avoids crosses
@GrapheneOS@Starkimarm@tris@SuperDicq@toatrika@lxo I am not going to get into a license war in this thread because I think it's unprovable but my opinion is licenses that don't require returning changes allow big businesses to enclose the commons and result in being less free in the long run, and that such licenses would have precluded all the progress we have now. but of course I admit I can't prove that.
@sun@Starkimarm@tris@SuperDicq@toatrika@lxo If you make things freely available for anyone to use for any purpose, there's no requirement for them to share any of your beliefs or attribute any of the valuable work people have done to them. That includes instead believing it held it back. Most people writing and using 'free software' do not believe in the mountain of cognitive dissonance believed by an insignificant minority. Extremely few made any conscious decision to support any of it.
@SuperDicq@toatrika@Starkimarm@sun@lxo@tris Most people do not care about your contrived definitions of freedom where preventing them doing things is freedom and locking down the ability to do things is somehow freedom. You claim things are open and free which are not simply due to alignment with your ideology. You claim preventing users and not letting them make informed choices is freedom. It doesn't add up and is increasingly irrelevant. People doing most of the work don't buy into it.
@SuperDicq@toatrika@Starkimarm@sun@lxo@tris linux-libre is a highly insecure project based around misinforming and manipulating users. The project is thoroughly dishonest with users about what it provides and puts their privacy and security at risk. It puts ideology above people's well being and improving the world. That is what your movement does as a whole. You do not make things better, you make them worse all while you sabotage things and muddy the waters holding back progress.
@GrapheneOS@Starkimarm@tris@SuperDicq@toatrika@lxo it's very clear you're right, most engineers don't care about politics and they used the licenses because of network effect but you look around and now more than ever many express open contempt for free licenses of any kind despite using them, openness is not really in their DNA. that's okay I'll keep using their software, forcing people not to be antisocial is a property of civilization.
@sun@SuperDicq@GrapheneOS@Starkimarm@lxo@toatrika@tris >the ideological extremist position of groups like the FSF The FSF isn't an extreme, it's only an extreme from the perspective of proprietary entities. Otherwise the FSF is a neutral as an individual/public entity should be, it allows the free market to exist.
@SuperDicq@toatrika@Starkimarm@sun@lxo@tris Your movement largely consists of people on 4chan and equivalent sites. It's filled to the brim with both tankies and fascists. Few are developers or building anything relevant. People writing software under licenses like the GPL doesn't make them part of your movement. It doesn't mean they believe in any of it. It's largely people who spend their time proselytizing and trolling people on social media. Funny calling people useful stuff larpers.
@GrapheneOS@grapheneos.social@toatrika@plasmatrap.com@Starkimarm@23.social@sun@shitposter.world@lxo@snac.lx.oliva.nom.br@tris@chaos.social GCC and glibc are hardly even tied to your movement anymore. They're more big tech projects than tied to your community.Nope, not true at all. I know a bunch of GCC developers and they are all very much part of the GNU project. GCC and binutils aren't used as part of building GrapheneOS.You don't even know how to build your own project? Doesn't GrapheneOS use the Linux kernel compiled using GCC? Do you guys use Clang instead or something?
@SuperDicq@toatrika@Starkimarm@sun@lxo@tris You take credit for things you have no involvement in. GCC and glibc are hardly even tied to your movement anymore. They're more big tech projects than tied to your community.
As a side note, GCC and binutils aren't used as part of building GrapheneOS.
@GrapheneOS@SuperDicq@toatrika@Starkimarm@lxo@tris this actually reminded me I have to get back to work, I respect your project even if I don't agree with you and you insult people like me with untruths
@GrapheneOS@Starkimarm@tris@SuperDicq@toatrika@lxo fwiw my framing would be that sometimes you can't have both freedom and maximum security and you have to make a choice. I am personally not a gnu maximalist I just see their maximalism as a thing that has protected me overall. I make choices sometimes that don't jive with libre politics but I also don't frame them as actually freedom either.
@sun@Starkimarm@tris@SuperDicq@toatrika@lxo Earlier, there was an attempt at promoting a product based on it having an insecure extra firmware component which due to the ability to update it was able to be replaced with an open source replacement. The baseband firmware is still entirely closed source, but the extra CPU between it and the OS can run something else.
How is it logical to claim that not being able to update that would have been more free and more open? It makes no sense.
@sun@Starkimarm@tris@SuperDicq@toatrika@lxo Preventing updating it doesn't make it go away. It doesn't mean it's hardware. Hardware is also more rather than less limiting anyway. Closed source software can be reverse engineered, analyzed and replaced in a way that's not nearly as possible with hardware.
Firmware that's unobfuscated and loaded by the OS is more open to inspection than having it stored on the hardware without having access to the code. It isn't somehow freer to do that.
@sun@Starkimarm@tris@SuperDicq@toatrika@lxo A device with very complex closed source hardware and firmware is not an open device. It does a huge disservice to people working on working that to pretend as if not updating the firmware makes it open. It's nothing less than scamming people to falsely market products this way. The product being promoted above doesn't even try to do that in the first place. It would be significantly worse if it did. It would not be more open but rather less.
@sun@Starkimarm@tris@SuperDicq@toatrika@lxo In fact, they make and promote products which take regular hardware which supports firmware updates and blow fuses or otherwise modify it to prevent updating it. In some cases, they're taking away the ability for people to write new firmware to replace the existing firmware.
It is very much 100% possible to sell a variant of hardware where fuses for verified boot are not burned with tools for the user to do it if they want, or not do it.
@sun@Starkimarm@tris@SuperDicq@toatrika@lxo They are not freedom maximalists. They care little abouit open hardware and open firmware. It has been repeatedly stated in this thread that blocking updating firmware/software means it doesn't count and can be proprietary, closed source code. To them, it only counts if someone could make an update. Therefore, they don't care about it for software either according to what has been repeatedly stated here as long as updates are not possible.
@sun@Starkimarm@tris@SuperDicq@toatrika@lxo Due to them defining a loophole in their ideology where blocking updates makes it not count, they're encouraging taking away user control rather than granting it. That is exactly what was done with the Librem 5 taking away ways of updating firmware, putting blobs on a secondary CPU and preventing replacing the software there, etc. That is not more open or more free, but less. They defined a huge loophole in their rules and gaming it is encouraged.
@sun@Starkimarm@tris@SuperDicq@toatrika@lxo In fact, they make and promote products which take regular hardware which supports firmware updates and blow fuses or otherwise modify it to prevent updating it. In some cases, they're taking away the ability for people to write new firmware to replace the existing firmware.
It's 100% possible to sell hardware where fuses for verified boot are not yet burned along with supplying tools for users to do it. How is blocking updates more free?
@GrapheneOS@Starkimarm@tris@SuperDicq@toatrika@lxo liberty is personal freedom but some people care about institutional freedom, and being forced to contribute back your code maximizes freedom. license incompatibilities are just a thing that exists in the fallen world where you have standards of behavior but have to make concrete decisions about implementation that will never be good enough for all situations.
@sun@Starkimarm@tris@SuperDicq@toatrika@lxo Linux kernel is GPLv2 only. The code cannot be taken and used in an GPLv3 project. This is a very clear restriction on how the code can be used which is very often relevant. These kinds of license incompatibilities between licenses considered 'free' are a result of restrictions on how the code can be used. Some major projects exist due to these silly incompatibilities.
State enforced rules about how you can use the code is not freedom maximalism.
@sun@Starkimarm@tris@SuperDicq@toatrika@lxo End result is closed source hardware with closed source firmware where work actively went into preventing the user from doing things in a way that harms security. It's a way to lower privacy, security and freedom all at once. This is the problem with having an ideology incredibly detached from anything to do with people's well being where it's largely just rhetoric and gaming it.
It's similar to pretending as if GPL doesn't limit freedom.
@sun@Starkimarm@tris@SuperDicq@toatrika@lxo GPL does not force contributing anything back. It is not the intended / stated purpose. It forces giving the code to the users it's distributed to, not the upstream project. The upstream project can potentially get the code if they can become users of it or if compliance is done by just publishing it publicly but that's not mandatory. The code doesn't have to meet the upstream standards and be at all close to something which could be used.
@sun@Starkimarm@tris@SuperDicq@toatrika@lxo The reason most developers chose to use GPL licensing is because they thought it would result in getting contributions back and not having themselves get taken advantage of. It does not actually do that.
Some projects have been moving to non-commercial usage licenses from GPL because they're upset big companies are using their code without giving anything back.
Code also often isn't distributed outside of a company.
@sun@Starkimarm@tris@GrapheneOS@SuperDicq@toatrika@lxo my favorite feature of the GPL is that I can start a factory and use GPL code that I've modified to run my robots and become super successful building and selling my widgets and never give a single line of code to anyone because the only user of the code is *me*
@sun@Starkimarm@tris@feld@SuperDicq@toatrika@lxo They're describing what most companies do with GPL code: they use it internally. It's the large companies like Facebook, Google, Amazon, etc. where they have a ton of things like Linux kernel performance improvements they use internally and have no requirement to publish. Google tends to eventually try to upstream stuff but most companies don't. It also takes a very active effort to get it upstream. It's typically very hard to do.
@GrapheneOS@sun@Starkimarm@tris@SuperDicq@toatrika@lxo I know for a fact that one of the big video streaming operations run by my employer has custom Linux kernel modifications that will never be shared with anyone, ever. 😇
@feld@Starkimarm@tris@GrapheneOS@SuperDicq@toatrika@lxo the problem is the billion/trillion dollar companies (like broadcom) that use GPL code in their end user products and are too big to be sued. Well, this is a problem with the existence of trillion dollar companies, no license is going to save you
@GrapheneOS@sun@Starkimarm@tris@SuperDicq@toatrika@lxo people also forget that hardware development is just as vital to our progress as software development and as I posted about before, David Chisnall shared an experience where they needed to get new ARM cpu designs into the hands of testers but they had an NDA and couldn't publish the designs and QEMU being GPL meant they couldn't share a modified version of QEMU that conformed to the new CPU design...
GPL feels like it's trapped in the 80s/90s mindset of computer culture
@sun@Starkimarm@tris@feld@SuperDicq@toatrika@lxo It does very little to get contributions back to the upstream project and ecosystem. That's often true when distributing code to users too. Being forced to give the users the code doesn't mean it's going to get to the upstream project and doesn't mean the code is useful to them.
The main reason developers choose GPL is trying not to get taken advantage of, not the actual spirit / purpose of GPL, and then they often get very disappointed.
we are not removing warnings, to the best of my knowledge. please report any occurrence of warning removal, it's a bug that ought to be fixed.
we do indeed lower the temptation to use nonfree software to work around a hardware (+ embedded software) bug, acknowledging that making the user more vulnerable to strongarming by suppliers doesn't make things better for users; empowering vendors to enshittify products rather makes things worse for users.
short-term thinking, such as trading your freedom for some temporary security, leads to various ruinous compromises
plugging one hole while widening a gap that allows a third party to take further control of your computing doesn't make you more secure, it makes you more vulnerable.
@SuperDicq@lxo Pretending the closed source firmware (and hardware) doesn't exist by leaving it not updated or choosing components which don't require the OS to load it does not make it go away, and does not make it more open. Components with closed source firmware stored on them are not more open than components requiring the OS to load it.
Fighting for having firmware/software updates disallowed is not fighting for freedom. Locked down devices without user control or updates meet your bar...
@SuperDicq@lxo People who actually want open source hardware and firmware should have a huge problem with projects being marketed as providing that when they don't. Purism presents their devices as being open over and over again which then results in tech media widely claiming their open hardware which they absolutely aren't. Pine64 doesn't do as much of that, but they do a bit of it. People who actually want real open hardware and open firmware should in fact have a major issue with that.
@SuperDicq@lxo Having a Qualcomm baseband on a larger SoC with a CPU running a closed source fork of Android and then replacing that closed source fork of Android with something else still leaves you with a 100% closed source firmware baseband and 100% closed source hardware for both the baseband and overall SoC. Presenting that as open source because a usually non-existent CPU can have the software replaced is promoting closed source hardware and firmware as being something it isn't at all.
sorry to disappoint you, I won't stoop down to name calling like that
that you don't understand and misrepresent our principles doesn't entitle you to as much as claim you disagree with it, or to make false statements and incorrect assessments about it.
let me try to present it in terms that will hopefully make sense to you.
a rock respects your freedom. it does nothing. it sits there, without denying you freedom. that's what "respecting freedom" means. it doesn't mean enabling you to do things, it means not standing in the way of your doing things. got it?
a piece of computing hardware doesn't normally stop you from doing such things as studying it, changing it, or copying it; that these activities are often impossible is not a consequence of someone's evil plan to block you from doing them, but from the nature of computing hardware. ICs are not transparent, not amenable to modification, and require extremely expensive equipment to make. so there are difficulties, but it's not necessarily like the hardware (or someone designing it) is actively placing roadblocks to stop you from doing those things (I'm sure there are exceptions, and they should be dealt with as such), it's just that these freedoms are not readily available for hardware as they are with software
this is true whether components of the hardware are hard circuits, programmable circuits, or programs equivalent to circuits. when one replaces a hardware circuit with an equivalent program, there's no loss of freedom for users, and there's generally no ill motive for the replacement.
now, if the program is taken out of the black box, then it takes an active decision to keep it proprietary, to deprive users of freedom over a program they can no longer be oblivious to. that's the very same ethical issue that's brought about the free software movement, and also free hardware and even free culture, to some extent.
so, no, we're not saying the black box is free, or that some software hidden in it is free; but we do say that it respects your software freedom, because whatever software there is inside the black box is immaterial, and it might as well have been hardware proper, without any (further) freedom deprivation. it doesn't boost your freedom, but it doesn't deprive it either, it merely respects it, i.e., it leaves your freedom alone.
hopefully this will help you avoid embarrassing yourself by uttering nonsense about that which you do not understand
indeed, we don't have a monopoly on ethics. we don't even have a monopoly on the ethical foundations upon which the movement is built, such as the golden rule, that we shouldn't do unto others if we don't wish it done unto ourselves.
it's very common for those who have become dependent on those who mistreat us all to turn against us, as if we were the ones doing the mistreating. because of their dependency, they don't see that the harm comes from those who mistreat us. our standing against the mistreatment is not wrong; giving it to it, and enticing others to join in tolerating the mistreatment is.
rational people can see that further empowering the abusive parties won't solve the problem; that making it more difficult for them to infiltrate and navigate in our free cyberspace is more conducive of a solution that allowing them to rein in. but those who've become dependent on them often resent that the abusers' hooks aren't welcome.
no, sir, thinking that freedom arises from licensing is a view very alien to that of the movement I espouse. it is one that is frequently pushed by confused open source promoters, though.
you gain trust over something by inspecting its behavior and/or its blueprints. the former is how we make science out of things that don't have blueprints available; the latter is how we deal with man-made artifacts whose inner workings are relevant/essential to our uses thereof. when it comes to IT and avoiding its use as a tool of control over us, the former works for hardware, and to simple software that doesn't change from under us; the latter is required for most other software. without blueprints (that change along with the objects, when you wish to change them), analysis of unchanging behavior is what remains, and then, the older the thing is, the more likely it is that we have a solid picture of how it behaves.
@jeffcliff@Starkimarm@tris@SuperDicq@toatrika@lxo You want people to trust software on faith alone based on licensing. You also expect them to trust the hardware and firmware on faith alone as long as it doesn't allow updating the firmware. You folks simultaneously promote proprietary hardware/firmware while telling people they can't trust proprietary software. There's no consistency or logic to it. You pretend to care about things you clearly don't to sell people on the strange ideology.
>Most people find it to be ridiculous nonsense, not only us.
Appealing to the *appearnce* of ridiculousness is a logical fallacy. What's *actually* ridiculous is expecting anyone to trust a firmware update on faith alone.
@lxo@SuperDicq@toatrika@Starkimarm@tris You are removing security patches and removing security warnings. You are misleading users and tricking them into having insecure devices while convincing them they're better off based on your ideology. You are not fighting for freedom, privacy and security. You are fighting for completely arbitrary rules where blocking people updating components somehow cancels out the fact that they're proprietary. That has nothing to do with what you claim to value.
@GrapheneOS@Starkimarm@tris@SuperDicq@toatrika@lxo I think the compromise here is acknowledging there's prorprietary firmware bits on existing hardware to get rid of, and not adding to them, but something tells me you don't agree with that.
@jeffcliff@Starkimarm@tris@SuperDicq@toatrika@lxo The eventual goal is that we want open hardware, open firmware and open software with a balance of privacy, security, usability and compatibility. What we make today is what we are capable of doing which balancing priorities. Our specific focus differentiating what we are working towards from other projects is serious work on privacy and security. Current software, firmware and hardware has atrocious privacy and security. It is our focus.
@jeffcliff@Starkimarm@tris@SuperDicq@toatrika@lxo If you want us to respect your views on it, start being consistent by not drawing an arbitrary line where blocking updating firmware/software makes it not count. If you stop doing that the focus could be on making actually open and freedom respecting hardware instead of playing games pretending hardware/firmware isn't proprietary if it can't be updated or that it's not relevant in the same ways. As is it's just unserious and downright silly.
> Open source software is in fact a black box to most people.
If someone has an issue with Free Software, they can go to someone with the skill and tools necessary to audit and change it. Software Freedom gives them that ability. This has been an issue since the beginning of the free software movement -- that not everyone is a developer. But with access to the corresponding source code people can learn, and design social institutions around learning and teaching about that code. The whole of society can wrap tighter around the harder to understand parts and deal with them as sources of complexity to the extent they become problems.
> Even for software developers, they're still trusting the people making it.
There's a certain degree of trust, sure, which is why it's crucial that we build a basis for that trust in
> The idea that preventing people updating firmware or even preventing replacing it with different firmware is somehow more free is nonsensical.
Of course you're free to update firmware if you have the tools. But if the firmware is proprietary, what you are doing is incorporating proprietary software into your life -- a harmful act to the world around you. And the control you get is illusory and fleeting - it will work until it doesn't, and then you have no idea why. It behaves *like almost-impossible to troubleshoot hardware*.
>Taking away a capability from users to use as they wish is not giving them freedom.
the analogous situation is this
"Not being able to run proprietary software on my free OS doesn't make you more free"
Perhaps so - having some functionality to load firmware even proprietary firmware is justifiable. Just like being able to run proprietary games on linux is desirable by some people. But the actual loading of that firmware is an antisocial and harmful act, and an act that introduces an incredible amount of complexity and distrust into a device and a situation. And in fact, not having proprietary games *does* make you more free, even if you *can* install it -- to a measurable amount. Similarly for firmware: most non-cpu devices will simply not work if the firmware isn't present. Perhaps there are some that will work more poorly - that is a *hardware design flaw*.
Generally speaking, however, take your issues about being *allowed* or not to upload oem-poisoned firmware to someone else. I'm not stopping you from uploading firmware on your own hardware. But it'll stay as disabled as I can make it on mine.
@jeffcliff@SuperDicq@lxo Open source software is in fact a black box to most people. Even for software developers, they're still trusting the people making it. You're conflating different things together.
The idea that preventing people updating firmware or even preventing replacing it with different firmware is somehow more free is nonsensical. Taking away a capability from users to use as they wish is not giving them freedom. Taking it away doesn't make it freedom respecting or open.
>Fighting for having firmware/software updates disallowed is not fighting for freedom.
On the contrary: it limits the amount of control over the hardware the manufacturer has to what was built in to begin with. Users being allowed to "update" only with black box magic doesn't give users any more control over it.
I'm with @lxo : this is a difference between 'open source' and actual software freedom - agency over the device itself requires more than merely black box updates, but maybe in the "open source" worldview this isn't actually desirable.
I know it removes pointers to blobs and recommendations thereof, including to microcode. but the warnings about microcode vulnerabilities should be there. what is the warning message about microcode vulnerabilities (rather than recommendations to install microcode with wider vulnerabilities) that you expected but that we've supposedly removed?
@lxo@SuperDicq@toatrika@Starkimarm@tris linux-libre removes warnings about outdated microcode. The warnings exist due to known security patches. Nothing about that is misinformation. Many of the security vulnerabilities are public knowledge and that includes ways to exploit them, so it's possible to test for whether they are patched or not separately from microcode versions. Not shipping microcode/firmware updates means not patching vulnerabilities. Removing warnings about it is hiding that.
Indeed one of the reasons why Unix code got removed BSD was because of the stupid AT&T lawsuit, I agree.
But the very first version of BSD that was free was 386BSD in 1992.
Keith Bostic, who spend 4 years (from 1988 to 1992) removing proprietary code from BSD in 1988, said the following (direct quote) "I think it's highly unlikely that we ever would have gone as strongly as we did without the GNU influence"
Without GNU, there would not have been an unencumbered version of BSD, or at least it would've arrived much later. Linus Torvalds himself said Linux wouldn't have been created had BSD complete then.That is totally fine. I find it likely to believe that in this potential alternative timeline GNU would've probably continued development without Linux. I don't think the project would've died.
The first release of BSD, 1BSD, is older than the FSF. It was distributed unencumbered, on a tapedrive, for 50 USD, around UC Berkley and other colleges, with sources and binaries. Bill Joy wasn't gonna get royalties from you either, that shit was yours to keep, sell, whatever, as far as anyone was concerned.
even if the FSF and the free software movement had started in the age of dinosaurs, even if richard stallman himself had held the people at berkley at gunpoint, that shit was gonna be free. It was shared freely before it was even a full OS.
No one "pressured" anyone to do anything, if anything, AT&T pressured the CSRG to replace the dependance on propietary Unix code with free code.
you are fighting to demostrate a sliver of relevance of your retarded hippy nigger proyect and failing.
The one regrettable thing in BSD's history is that BSDi vs. USL lawsuit that set back releases of BSD 2 years. Linus Torvalds himself said Linux wouldn't have been created had BSD complete then. Perhaps GNU would've died 20 years earlier than it did and we wouldn't have to deal with its utter dogshit software and its worthless, subhuman community. But alas.
@SuperDicq@GrapheneOS@toatrika@Starkimarm@tris If it's ROM, it's not software, it's hardware - as nobody can change it - it's irrelevant that the circuits happen to encode microprocessor instructions - the only question is if there is a malicious circuit.
@GrapheneOS@SuperDicq@toatrika@Starkimarm@sun@lxo@tris >That is what your "libre" projects do. They mislead people, hide important information from them and leave them vulnerable. Ah yes, the libre projects that document the problems are misleading people.
No free software program prevents the user from loading anything - the user is free to load whatever they want, or not load what they don't want.
It's only proprietary software that prevents the user from loading what they want and prevents them from not loading what they don't want.
Meanwhile, GrapheneOS ships a crapload of proprietary software, seemingly without even properly documenting it! (you need to look through the release images and work out which parts are proprietary?).
@tris@SuperDicq@GrapheneOS@toatrika@Starkimarm@sun@lxo GNU/Linux-libre likely has hundreds of thousands, or millions of installs (as that's what Trisquel and other free distro's are) - but it's hard to arrive at a specific number, as the users are not spied on.
@tris@SuperDicq@GrapheneOS@toatrika@Starkimarm@sun@lxo GNU/Linux-libre likely has hundreds of thousands, or millions of installs (as that's what Trisquel and other free distro's are) - but it's hard to arrive at a specific number, as the users are not spied on.
Neither of those licenses require anything if you haven't distributed the software.
Requiring people to work out that x package is used and demanding the source code is not compliant distribution (although nobody will really care if you actually supply the actual source code, of the correct version) - depending on the distribution method, there needs to be a written offer, or the source needs to be included, etc.
There is the AGPLv1, AGPLv2 and AGPLv3.
The AGPLv3-or-later does not require code be public by default - you don't have to do anything if you don't distribute or modify the software.
It's only if you modify the software does the users of the network service need to be provided the source code (such modified versions do not need to be public - those only need to be available to the users for the network service - although the users may choose to make the modified versions publicly available, as that's freedom).
@sun@GrapheneOS@Starkimarm@SuperDicq@lxo@toatrika@tris As far my understanding of the the GPL goes, it never forced companies/people to share anything immediately, but only when people having a binary of it asked for access to the code. The AGPL is the license that mandates code and code changes to be public by default, which is a very good defense for customer of SaaSS economical models.
@SuperDicq@GrapheneOS@toatrika@Starkimarm@sun@tris@pernia GNU would have put more work into development of the Hurd (which started before Linux) without Linux and arrived at a convenient enough, fully free OS, that would have stayed free a couple of years later.
BSD code was pretty much unusable at the time, as the licensing was not in order (much of it still isn't).
@sun@Starkimarm@tris@feld@GrapheneOS@SuperDicq@toatrika@lxo Broadcom is not too big to be sued - even if a company is massive, if you are the copyright holder and have hard evidence that they're intentionally infringing your copyright and have terminated their license and they continue to distribute, they will lose the case every time.
Broadcom does not infringe the copyright of GNU software, as they know the FSF would sue them and win.
The issue is that Linux's license is usually not enforced by its copyright holders, which means Broadcom gets away with infringing Linux's copyright.
@pernia@Starkimarm@tris@GrapheneOS@SuperDicq@toatrika@sun@lxo >free software like ssh Yes, openssh is the single free software package from the BSDs that is technically superior to other ssh implementations - it still relies on GNU libraries and others on GNU/Linux.
>openssl It seems that relies on GNU and it could not have been written without GNU.
>clang Clang could not have been written if it wasn't for GCC.
>toybox That garbage is as useful as a box of toys.
@BionicNigga@Starkimarm@parker@tris@GrapheneOS@SuperDicq >@toatrika@plasmatrap.com @sun@lxo >sparking the open-source movement "open source" infidelity didn't begin until 1998 and that had nothing to do with Linus - it was Christine Peterson, Todd Anderson, Larry Augustin, Jon Hall, Sam Ockman, Michael Tiemann and Eric S. Raymond who pushed the term, none of which have much to do with Linux.
Linux was released as proprietary software in 1991 and became proprietary software again in 1996, thus it clearly has nothing to do with "open source".
The "open source" movement was build on top of the GNU/Linux OS, as an attack against those who made it all possible.
>that successfully built an operating system around it GNU built the OS, that many others added too - including Linus, who added a substantial missing piece.
>Your moobment‘s kernel doesn’t even work on real hardware What are you trying to achieve by lying to someone who knows about such things?
GNU has multiple kernels that all work.
GNU GRUB's kernel works on real hardware.
GNU Linux-libre works on real hardware.
GNU Hurd works on real hardware, although it has a limited amount of drivers (unlike a certain BSD, no GNU/Hurd OS image that only boots on a VM has been released).
@Suiseiseki@parker@Starkimarm@tris@GrapheneOS@SuperDicq@toatrika@sun@lxo Linus Torvalds wrote the Linux kernel, sparking the open-source movement that successfully built an operating system around it. Your moobment‘s kernel doesn’t even work on real hardware because nobody likes you or wants to work with you, precisely because of these kinds of autistic semantics. Deal with it.
Nobody else is GNU enough to get such important work done and credit is due for such work.
Removing the proprietary software has practical benefits - one is that it is actually possible to distribute Linux without infringing its license (if you infringe Linux's license by distributing it combined with proprietary software, your license is immediately terminated).
> Linux-libre Oh dear, you wouldn’t be taking credit for other people’s software now, would you? Unless you really think that simply removing bits that don’t pass your ideological purity test makes you the author of a piece of software.
The same is true for Linux - some people develop on GNU/kBSD's or GNU/Hurd or GNU with another proprietary kernel - thus Linux can be excluded from the same, although it is included to give credit where credit is due for GNU/Linux.
But if you want to develop something that is free software, you'll certainly need GNU.