Re: [GNU-linux-libre] is this work-group still serving the community?

[Denis 'GNUtoo' Carikli]

On Tue, 5 Oct 2021 11:42:03 +0300
Jean Louis <bugs@gnu.support> wrote:

> * bill-auger <bill-auger@peers.community> [2021-10-04 13:03]:
> > unfortunately, the FSDG simply "has no teeth" today;
[...]
> What it lacks really is communication. When we file reports at
> Parabola or other distributions, we can as users see their
> responses. There are sometimes forums, users gathering, we can get a
> feeling of activity behind.
Indeed, I think that the problem of communication is more general. How
can we expect distributions to really get the point of the Guidelines
if people come and go and don't even participate or follow somehow in
this mailing list?

If you take Guix for instance, it probably attracts many different
backgrounds, it's for instance used in science, for high performance
computing, to build bitcoin for windows in a trustworthy way, etc.
And given the huge opportunities we have with Guix[1] I think that it's
crucial to make it work.

So given how imperfect is human communication, it's logical to expect
that some issues will arise, and the question would rather be how to
fix it so everything worth smoothly.

And we can't really force people to read every mail either but if we
make some system where distributions do have a say in decisions, and
practically speaking decide collectively, in one way or another
distributions will have to participate at least to take the decisions
that also affect them directly.

And given that not everybody interpret the guidelines in the same way
we could at least take decisions that clarify them.

And in turn I hope that a system like that would make developers and
users of such distributions more aware of the FSDG.

For projects like Guix for instance, it could probably be improved by
making sure that new contributors, especially people that never heard
of the FSDG before, do not miss that information.

An example of that would be to make it really prominent in the
instructions to contribute (if it's not done already) or in other
places where contributors would go, and try to explain it to people
that didn't really understand it in general, and if possible try to
convince them with good arguments that it's a good thing for Guix.

Though the priority here is probably that "communication must flow", and
to build the process to make sure it flows.

And here good communication would probably benefit all the FSDG
compliant distributions out there.

> While FSF is important and by its endorsement contributes to promotion
> of fully free software, everybody is free to make their own set of
> rules or norms and policies how distribution should be, or in which
> way should it be considered "fully free". Distributions have their
> policies and differ to each other. I consider some of them more free
> than others, for example Hyperbola is for me on top of the list, they
> are creating distribution for the reason to be fully free. That is my
> impression. 
There is not only that to consider but also how strategic are the FSDG:
if we want free software to scale, things must be as simple as possible
for users. And if we have too much norms, it would prevent that.

And as a given norm cannot handle everything we do need several norms.
For instance there is also the RYF certification. And there are also
norms that don't take comes from outside free software that might also
be relevant for people (like fair trade, etc).

Also note that while I believe that while they are strategic, norms also
do have many limitations:
- Here they don't magically make other distributions ship only free
  software. But they could be leveraged to help going in that
  direction. For instance people who want to work to fix issues (like
  for instance replacing nonfree firmwares with free software) can
  leverage such norms to help getting funded to work on fixing the
  issues for instance. If the gap between free and nonfree distros was
  smaller, it could also push more distros to respect such norms.
- They cover only some narrow aspect of free software. Broader issues
  like inclusion for instance will be harder to fix with just norms.

> Some distribution may be fully free only for the reason to promote
> sales of their notebooks or phones. That is business decision, and
> nevertheless valid. But it cannot be my choice, as I cannot get
> impression that such has purpose for free software. Impression is that
> purpose is to sell hardware. And I rather go with better
> purpose. Nothing against selling hardware, subject is the purpose.
I think we do get something in return here in many ways, however there
are also downsides too. With the case of Puri.sm and PureOS, we have
many advantages:
- We have a rolling release distribution that is FSDG compliant and
  that is based on Debian. It works on 64bit x86 and 64bit ARM.
- We have hardware that can be bought that works with PureOS and
  probably by extensions most other self hosted GNU/Linux FSDG
  distributions too out of the box.

The issue is that many people probably do think that the hardware they
sell runs only free software because it runs Coreboot. And since on
modern Intel computers, Coreboot uses a huge nonfree software (called
FSP) that initialize almost all the hardware, the reality is really far
from the expectations of at least the users I talked with.

If we manage to fix the later in some way or another and scale that in
general to make sure people are informed correctly, I think we could
build good relationships where everybody benefits.

For instance buying a Puri.sm laptop is probably a better idea than
buying off the shelf computers that don't even work with FSDG compliant
distributions.

And if all the people that buy off the shelf laptops of similar prices
in the FLOSS community switch to hardware that:
- works with FSDG compliant distributions
- gives the company that produces it more power to influence the supply
  chain and that this power is used to gain more freedom and
  potentially fix other issues along the way (work conditions etc)
- does not prevent anyone from running modified software (hardware
  manufacturers typically lock down the Management Engine, some
  prevent users to run their own BIOS/UEFI, etc)

then even if it doesn't fix the underlying issues (most hardware either
isn't made specifically for free software or is hostile to it) it would
at least improve the situation in a way that could then be leveraged
even more to improve it.

In general we need to find ways to work more together to improve the
situation, but we also need to make sure that norms like the FSDG and
the RYF certification work well. 

We could even consider such norms more like rivalous common goods as
they require people to actually do work (like review distributions etc)
and they should not be abused (for instance by trying to lower the bar
all the time) by distributions or hardware vendors but instead they
should contribute to it to make sure it works fine.

And with the Free System Distribution Guidelines I think we have an
ideal situation where we could really make good processes, as the
knowledge is already well distributed, even if that really needs to be
improved.

Something like that would be harder to do with the RYF certification as
knowledge about hardware is less distributed and probably requires more
time to learn.

References:
-----------
[1] I think that it's really strategic to have a distribution like Guix
    that is FSDG compliant:
    - It's probably only FSDG compliant self hosted distribution that
      isn't based on another non-FSDG compliant distribution.
    - It could also show many other communities that the FSDG
      guidelines do exist, what they are, etc.
    - Its software design is really good and it enables us to solve many
      issues that weren't possible before: 
      - For instance we have huge issues with the Android build system
        in Replicant. That could be solved with Guix.
      - If you want to build software for other architectures or OS, you
        pretty much need to either write your own distribution or use
        non-free distros. Guix also solves that.
      - Software deployment is also a big issue we are facing. Many
        software distributed though containers use nonfree distros for
        instance. Here Guix also solves that.
      - We have also a big issue with programming language package
        managers where adding everything from it doesn't scale with
        regular distributions. Guix also solves that as it makes it much
        faster and easier to make packages from such repositories (with
        guix import).
      - If it stays FSDG compliant it has the potential to pressure
        other projects to make their software FSDG compliant: what if
        one day the Tor Browser is interested in being built through
        Guix and even shipped in Guix (because Guix goes beyond
        reproducible builds)?
        Maybe the tor-browser would stop pointing to an addon repository
        that also has nonfree software to do that. 
        In addition FSDG compliant distribution users could also get
        the tor-browser through Guix with no risk of having their
        anonymity compromised because the browser would be bit-by-bit
        identical. 
    And the list of ways Guix could be leveraged to fix problems
    probably goes on and on. And some of the advantages here would be
    lost with a fork for instance (like the ability to pressure
    software projects, or promoting the FSDG guidelines outside of
    their project).

Denis.

pgpxAW2O8XbQF.pgp
Description: OpenPGP digital signature