Discussion July 2016

discussion@lists.fsfe.org

20 participants
14 discussions

Please help us spread the word on Roundcube Next
by Georg C. F. Greve 29 May '17

29 May '17

Dear all, In the spirit of full disclosure, let me start by pointing out that I am CEO and - along with other employees, some of whom you will also know - shareholder of Kolab Systems AG (https://kolabsystems.com) and that Kolab Systems has been the driving force behind Roundcube for the past years. Kolab Systems has also agreed to help the Roundcube Next team in its aim to refactor and build the next technology generation. So I am not neutral. That said, I genuinely believe it is extremely important for the Free Software community to get behind Roundcube Next and help us push it forward, as well as bring others on board with it. The longer story is here: http://blogs.fsfe.org/greve/?p=676 TL;DR, Part I: As a community we *require* technologies that compete with Google Apps, Office 365 and the likes in features, convenience, UI/UX, yet provide full control and freedom to users. TL;DR, Part II: Application Service Providers should get on board with that push *right now* because otherwise they will find themselves forced into becoming re-sellers for Office 365 and Google Apps -- and increasingly unable to compete with their features & networking effects. Some already understood this, and have joined the Roundcube Next community, such as cPanel (http://blog.cpanel.com/on-to-the-next/), Tucows, and now also Fastmail (http://blog.fastmail.com/2015/06/05/fastmail-supports-roundcube-next-develo…). But there are many more providers using Roundcube today who have not joined, nor have they contributed in the past. For them it should be obvious to join. And then there are those that have their own home-brew interfaces (such as Fastmail) who get the unique opportunity to become part of a new, growing community that will create a technology that will make them fully competitive against the "big clouds" in 18 months from now. Unfortunately, most of them have not realized this yet. So unless your provider is cPanel, Tucows, Fastmail or Kolab Now, all of who are part of this already, please encourage them to step up and join the community to push for Roundcube Next. Direct link for your convenience: https://www.indiegogo.com/projects/roundcube-next--2/x/4658765#/story Best regards, Georg -- Georg C. F. Greve <greve(a)fsfeurope.org> Member of the General Assembly http://fsfe.org/about/greve/ http://blogs.fsfe.org/greve/ http://identi.ca/greve

8 17

Article "FRAND And The Clash Of Industries"
by Matthias Kirschner 28 Nov '16

28 Nov '16

Dear all, Simon (in CC) wrote an article "FRAND And The Clash Of Industries". https://meshedinsights.com/2016/07/12/frand-clash-of-industries/ We would be interested in feedback about it. (This is related to the article "Why is FRAND bad for Free Software?" <https://fsfe.org/activities/os/why-frand-is-bad-for-free-software.en.html>) Regards, Matthias -- Matthias Kirschner - President - Free Software Foundation Europe Schönhauser Allee 6/7, 10119 Berlin, Germany | t +49-30-27595290 Registered at Amtsgericht Hamburg, VR 17030 | (fsfe.org/donate) Contact (fsfe.org/about/kirschner) - Weblog (k7r.eu/blog.html)

3 4

Uncorrectable freedom and security issues on x86 platforms
by Timothy Pearson 25 Oct '16

25 Oct '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 All, It has recently come to my attention that many in the free software movement are unaware of a relatively new development on x86 platforms that permanently removes the ability to use these platforms without also continually executing signed, proprietary code at the highest possible privilege level. All post-2013 (AMD) and virtually all post-2009 (Intel) systems contain this mandatory technology, and therefore, by design, can never be converted to run using pure FOSS. Prior to these changes projects such as coreboot could be used to replace the boot firmware with a FOSS alternative. The technologies in question are the Intel Management Engine (ME) and the AMD Platform Security Processor (PSP). Both serve effectively the same purpose; to ensure that the physical owner of the machine never has full control of said machine. These technologies, in turn, are used to implement various forms of remote control and Digital Rights Management (DRM) technologies, including Secure Boot, which even now requires FOSS users to purchase a license from Microsoft to boot FOSS on affected machines that lack an appropriate Secure Boot override. This includes, for example, many newer laptops. Major distributions have worked around this issue by purchasing a signing key from Microsoft for their binary packages, but the end user is unable to modify the signed software without a license from Microsoft, even though they have the source code available to them under the GPL. Furthermore, these signed, proprietary, binary-only firmware blobs must execute on the service processor(s) before the main x86 CPU cores are even released from reset (AMD), or will hard reset the entire system after around 30 minutes of non-operation (Intel). These blobs continue to operate on the service processor(s) as long as the system is powered on, and in the case of the Intel ME they also continue to operate while the system is powered off but still has access to power (e.g. plugged in or charged battery attached). These services processors have full access to system memory and all system peripherals, effectively giving the binary blobs executing on them a higher privilege level than even the operating system kernel. Due to the ability to access system peripherals, these proprietary blobs could easily contain code to exfiltrate encryption keys, remotely activate microphones and cameras, plant unwanted data, or simply remotely disable the ability of the machine to boot FOSS operating systems entirely. Finally, the Intel ME firmware can be forcibly updated by a remote entity; it is unknown whether the AMD PSP contains similar functionality at this time. So, what can an average user do? The obvious answer is to simply switch away from using the x86 architecture entirely. As Intel owns all rights to the x86 architecture, there will never be any new manufacturers licensed to make x86 chips, and therefore there will never be any competition to remove these DRM-laden antifeatures. There are numerous alternative architectures available, especially for those already using software with the source code available (i.e. FOSS), all of which can be licensed by other manufacturers should the need arise. ************************************************************************ General Overview of Alternate Architectures ************************************************************************ === ARM === While the ARM architecture may be more wildly known for locked-down computing products, there are several ARM devices on the market that allow full FOSS replacement of the boot firmware. Generally these are laptops, tablets, and embedded systems, with one example laptop being the ASUS C201 Chromebook: https://libreboot.org/docs/install/c201.html Using ARM in a mobile form factor also provides advantages of low cost and long battery life, albeit at the expense of overall system performance. === POWER === IBM has recently released their high-performance POWER8 architecture for third party licensing, and has also released a small treasure trove of firmware and documentation for these devices. POWER is the only architecture currently competitive with Intel in terms of raw performance, and boots using a fully FOSS firmware with no DRM antifeatures embedded. The primary disadvantage of power is cost, as it is currently targeted at the server and datacenter markets. We are attempting to bring POWER to the high-end workstation market in a FOSS-friendly form via the Talos™ Secure Workstation, but need additional interest to make this a reality: https://raptorengineeringinc.com/TALOS/prerelease.php === MIPS === Less well known than ARM, and with less vendor choice, MIPS is often overlooked. However, China has revived this architecture for general purpose computing with the Loongson core, and several machines are available using this processor. As a niche processor it has far worse performance than even a low-end ARM processor, but marginally better energy efficiency. Not recommended in light of ARM and POWER8: http://www.lemote.com/html/product/atx/2015/1227/8.html === RISCV === While this architecture is extremely limited in performance, price, and performance per watt compared to x86, ARM, or POWER, it is also one of the only fully open source CPU architectures available outside of an FPGA. and may eventually be competitive with MIPS in terms of raw performance. Currently there are no RISCV SoCs in production, however projects such as lowRISC aim to change that: http://www.lowrisc.org/ ************************************************************************ So, what are your thoughts on the current x86 proprietary software situation? Are you willing to continue to use FOSS software inside the ever-shrinking x86 "software jail", or are you possibly willing to give up some cost or performance advantages in order to retain full control of the software running on your hardware? This is a question that will need to be answered soon; the long-term consequences of a fully TiVo-ized computing world are not to be taken lightly, and thus far the free software community has put up very little resistance to the antifeatures being forced into modern x86 platforms. I hope to provoke wider discussion on these topics via this message. Thank you for your attention! - -- Timothy Pearson Raptor Engineering +1 (415) 727-8645 (direct line) +1 (512) 690-0200 (switchboard) http://www.raptorengineeringinc.com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iQEcBAEBAgAGBQJXAoLsAAoJEK+E3vEXDOFbstsH/0BrB1VLKuSDDPdV4C7qJQOc 5euFCVc3cjZJhl+oGHQ2LuSuDM6J9DuYRxJQq53Xx9WYrNMSuqNjcnaagIhew+Ci ocMEQNB3G7ob4+56kyYrOTL7YoqrFcqa9Y5rpBXBt5ufnYt/g3n1Zin7xQycJ/rP ldLeADsaTJpsRgWLBTDnOAmMGBh1Xv4d4w1ZYAgoNfGJD6nc7NhihajIMZRIgHIn /Uo2brToF6exizHFMGWLwYdEKLOkoau7Bmz5yaGKI0JJF7hzq/G9dpecKf42G1ra Fr9q07JHCre7JJrq6SlbjapJyDB+OOK+YoFDjTsxaikV8E20AIQG4VkS3DsL7rU= =47/v -----END PGP SIGNATURE-----

6 13

system-hackers service agreement
by Daniel Pocock 27 Aug '16

27 Aug '16

Looking at the thread about the new blog team, it is clear that some things are dependent on the relationship that teams have with the system-hackers group Ignoring the current configuration of the systems, what is the ideal service that the system-hackers would like to be able to provide? E.g. - which OS/distribution? E.g. Debian - would more than one OS be feasible or required? (this multiplies support effort, should be avoided) - will services run in virtual machines and which technology will be used (KVM, XCP, Openstack, ...), e.g. will the blogging service run in a VM isolated from the services operated by other teams? - benefit: each team can receive major OS updates at different times - disadvantage: extra effort for system-hackers team, needs more IP addresses - how fast can packaged security updates (e.g. from Debian) be deployed? Will the updates be automatically deployed by cron or something, or will the team aim for a 24x7 support roster? In the latter case, are more volunteers needed in the system-hackers team? - how will major upgrades (e.g. from Debian 8.0 to 9.0) be deployed? E.g. aim to begin upgrade 3 months after the official release, individual teams using a particular server can veto the upgrade until 7 months have passed - which services must be supported by the system-hackers (I'd suggest backups, public web site, wiki, IP address allocation, SSL certificate creation, monitoring, Git, DNS, authentication/OpenID/LDAP, mail, mailing lists, SIP, XMPP and any services that the system-hackers may depend on in the course of their own activities) - are the system-hackers willing to support a database such as PostgreSQL for use by other teams? Can they provide a convenient way for members of other teams to take snapshots of their databases for use in test servers? - will the system-hackers allow members of other teams to use sudo? Maybe there are other things too, it would be good to see the system-hackers provide a list of what you would be willing to support and a separate list of what people think they need the system-hackers to support.

6 12

GbU Hackers' meeting
by Paul Sutton 30 Jul '16

30 Jul '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi All I found this on Diaspora earlier, as it is in Europe, thought it may be of interest here https://www.gnu.org/ghm/register.html gnu hackers' meeting It would be nice if perhaps attendance of this can be extended to anyone with membership of the FSFE too, without having to be a direct member of the FSF. Anyone who is going have a great time, sounds fun.:) Just a thought Paul - -- http://www.zleap.net diaspora : zleap(a)joindiaspora.com sign up at : https://joindiaspora.com/i/29e3c17d2ef2 Torbay Tech Jam http://torbaytechjam.org.uk Software freedom day 17th September 2016 -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (GNU/Linux) iEYEARECAAYFAlec3cgACgkQaggq1k2FJq2FswCeMEIsgAGKTdKJ38JtHtg6/CeD xNIAn0HKBH4tNiZbqWvlbCgtfUBFYVMj =Kaqe -----END PGP SIGNATURE-----

2 1

Creative team wanted for an image film project
by Cellini Bedi 29 Jul '16

29 Jul '16

Hello everyone :) Just to give a small background first, I am the intern of the FSFE. Erik and I were discussing on how I should create a team for an image film project of the first ever summit / 15th year celebration of the FSFE that is going to take place on September 2,3,4. I have a tiny background of creating videos/editing them and a small portfolio of my works, but will need to create a small A-Team for this video project. Of course when creating a project like this, we need creative minds to brainstorm on the script, the idea, the theme and also technical stuffs on who has a good camera, mic etc etc. So if you know anyone interested in volunteering for a fun project like this please let me know! They could email me back and also probably apply for the scholarship program https://fsfe.org/community/events/2016/summit/attendance.en.html#scholarship Thanks for your time! Hope someone can reply if they know someone who could be interested in this :) Cheers, Cellini -- Imagine no European is any longer forced to use non-free Software! Save the date: September 2 - 4, 2016 - BCC Berlin, Germany Spread the word: https://fsfe.org/summit16#spread

1 0

some help regarding the copyright laws in De
by Gheorghe Zugravu 28 Jul '16

28 Jul '16

Hello, I got into an unpleasant situation in Germany with the bad famed law firm Waldorf-Frommer on the issue of copyright infringement - got a warning letter and bill to pay. I could see from reading online stories that is very ”popular” thing in Germany. Did someone had this problem already? Can you share your story here or send me a private message how you solve/deal with it? I am trying to figure out a strategy/tactic how to deal with this. In my case is the IP address of some relatives, and I dont want to cause any problems to them. thank you in advance! regards, /gheorghe

1 0

EOMA68 crowdfunding campaign (and those x86 concerns)
by Paul Boddie 27 Jul '16

27 Jul '16

Hello, I've mentioned this fairly recently in discussion threads on the security/surveillance concerns with x86-based platforms [1, 2], but I thought I should pass on the news that the EOMA68 initiative has opened a crowdfunding campaign for its products: https://www.crowdsupply.com/eoma68/micro-desktop The Free Software relevance here is that the hardware to be delivered supports a completely Free Software environment, with no proprietary drivers or firmware required. More discussion of that can be found here: https://www.reddit.com/r/freesoftware/comments/4qhm1y/earthfriendly_eoma68_… And Joshua Gay, of the FSF, participates in a discussion about the RYF (Respects Your Freedom) certification of one of the products in the campaign in the following message: https://lists.gnu.org/archive/html/libreplanet-discuss/2016-06/msg00212.html Meanwhile, the hardware is "open source hardware" at the circuit board level, and the physical design of the laptop being offered as part of the campaign is also freely available for people to print themselves if they really want to. One of the goals is to make sustainable hardware that is not unnecessarily resource-intensive to produce, hence the unconventional use of plywood panels in the case designs. What I find personally interesting is the modular aspect of the concept. There are lots of single-board computers but they are often either not particularly expandable or their accessories are infuriatingly specific (which may seem unproblematic if you are one of the many people using a Raspberry Pi, but the fun may lessen somewhat when they bring out a new version which is different in some way, rendering some accessories incompatible). In principle, this initiative could help people to concentrate more on developing other aspects of open computing devices. On the topic of the perceived problems with x86 platforms and the intersection of that topic with this campaign, there's a blog post by Think Penguin who have been sponsoring this effort: https://www.thinkpenguin.com/gnu-linux/crowd-funding-kick-backdoor-free-eco- consious-libre-computing The computer cards offered employ an ARM-based CPU, and it appears possible that other architectures will be offered at some point in the future. For example, a MIPS-based card was prototyped and it has been indicated that it isn't too far behind the ARM-based card in terms of readiness, but I don't intend to second-guess those involved in any of this. I'm hoping that other cards will be offered during the campaign, but they may end up waiting until afterwards for all I really know. Although I intend to support this effort, I am not endorsing it as such. This message is meant to inform people about the recent concrete progress of a project that has been many years in the making and has had its ups and downs, occasionally in a rather public manner [3]. There are other projects offering laptops and other "end-user-friendly" computing devices [4, 5, 6], and it is up to everyone to decide which one balances their own interests with what is being offered in a way that they find personally acceptable. For instance, some people might find the Librem laptop [5] an acceptable platform for running Free Software despite its reliance on an Intel CPU with the notorious "Management Engine", and they may be reassured by Purism's efforts to petition Intel to release the "Firmware Support Package" under a free licence [7]. Others may not expect Intel to cooperate, leaving the Librem susceptible to the concerns raised previously. Some people wanting x86-based hardware might find something like the APU1 [8] acceptable because it employs an AMD CPU that supports Coreboot, even if the hardware is not "open source hardware" (nor is the Librem, for that matter). I hope that, if nothing else, this has given people a few things to look at a bit more closely. I encourage people to ask questions about the campaign mentioned in this message if they are wondering about any aspect of it; there's a link at the bottom of the campaign page below the growing list of questions and answers. If nothing else, it will help people figure out where the next opportunity lies in open and free hardware for Free Software. Paul P.S. I would have blogged about this, but blogs.fsfe.org is not responding. But I guess the topic is worthy of discussion, anyway. ;-) [1] http://mail.fsfeurope.org/pipermail/discussion/2016-April/010913.html [2] http://mail.fsfeurope.org/pipermail/discussion/2016-June/011102.html [3] http://blogs.fsfe.org/pboddie/?p=933 [4] https://www.crowdsupply.com/sutajio-kosagi/novena [5] https://www.crowdsupply.com/purism/librem-15 [6] https://olimex.wordpress.com/2015/11/24/a64-olinuxino-oshw-linux-laptop- idea-becomes-more-real/ [7] https://puri.sm/posts/bios-freedom-status/ [8] http://www.pcengines.ch/apu1d4.htm

4 5

FOSSA - Now we need feedback by the real experts
by Matthias Kirschner 26 Jul '16

26 Jul '16

The goal of the "Free and Open Source Security Audit" (FOSSA) pilot project is to increase security of Free Software used by the European institutions. The FSFE has been following the project since the early beginning in 2014. I am concerned that if the project stays on its current course the European Institutions will spent a large part of the 1 Million Euro budget without positive impact on the security of Free Software; and the result will be a set of consultancy reports nobody will ever read. But if we work together and communicate our concerns to the responsible people in the Parliament and the Commission, there might still be a valuable outcome. Here the blog post with more background information about it: http://k7r.eu/fossa-now-we-need-feedback-by-the-real-experts/ As written in the post: As you are the real experts, now we need your feedback. What do you think about the deliverables themselves and what about our comments so far? I am especially interested if you benefit from the recommendations <https://wiki.fsfe.org/Policy/FossaRecommendations>. Best Regards, Matthias -- Matthias Kirschner - President - Free Software Foundation Europe Schönhauser Allee 6/7, 10119 Berlin, Germany | t +49-30-27595290 Registered at Amtsgericht Hamburg, VR 17030 | (fsfe.org/donate) Contact (fsfe.org/about/kirschner) - Weblog (k7r.eu/blog.html)

3 5

Commenting the FOSSA documents
by Luyin 25 Jul '16

25 Jul '16

Hello, I heard this is the address to turn to if I want to help to improve the FOSSA documents. So here I am ;) what should I do? Where should I concentrate my efforts first? Best regards, Alex -- I encrypt Mails using PGP. Find more information here: https://emailselfdefense.fsf.org/en/

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

2001

2000

Discussion July 2016