Freedom in computing - is (A)GPL enough?

[ilias.k.cs]

Hello and thank you for your efforts,

I'm a software developer from Greece. With the Snowden leaks, my worst suspicions seem to be true.Ever since then, I've been trying to replace all of "my" proprietary software with free software (and all of the services and formats I've been using with free equivalents).

It was very easy to commit to this decision as I know that with free software I can do everything I did before and in many cases better.
However, its realization can be a little tricky sometimes, as for every software package (and format or service) I'm interested in, I've got to make certain that it is actually free.

Being open-sourced or licensed under a permissive license, even under GPL, is ofcourse a good pointer but does not seem enough, as for example Linux itself contains blobs.
Checking at the fsf directory for the package is something I always do, but if is not there, this doesn't mean it's not free.
And for formats, I mostly check FSF and Wikipedia.
As you know, services make the situation much more complex. For example, I'm interested in distance learning and MOOC services like http://www.complexityexplorer.org/ are a gigantic temptation for me. But I want to know what systems are being communicated when I make a request to such a service.
EdX is open sourced under AGPL, but is this enough for me to know?

In short, how can I know what a system I am using actually does, in a legal way, besides sticking to the systems I know for certain that are free? How do we deal with uncertainty?

Many thanks and sorry for the long post.

Ilias K.

[Torsten Grote]

Dear Ilias,

congratulations to your switch to Free Software! :)

Post by ilias.k.cs
But I want to know what systems are being communicated when I make a request
to such a service. EdX is open sourced under AGPL, but is this enough for
me to know?
In short, how can I know what a system I am using actually does, in a legal
way, besides sticking to the systems I know for certain that are free? How
do we deal with uncertainty?

Unfortunately, this is something that can in my opinion not be ensured with
licensing. Even an AGPL service can send your data to somebody else in the
background. The only way to prevent this, is to use the AGPLed software and
run the service yourself for you. This is also the best way to make sure that
everything is really free.

Kind Regards,
Torsten
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 316 bytes
Desc: This is a digitally signed message part.
URL: <http://mail.fsfeurope.org/pipermail/discussion/attachments/20140105/e40cbc3c/attachment.pgp>

[Fernando Reis]

I understand your concerns with your privacy. I too have definitelly
moved away from proprietary software because of this.

It is indeed difficult to be sure that you're running only free
software, but there are some people dedicated to assure that the free
software packages are in fact free. In GNU's website [1] you can find a
list of distributions composed solely of free software.

However, in my own journey I found out that in order to protect your
privacy you need to go beyond the use of free software.
- Assess if you can trust the binaries you're downloading, even if
they are free software. The source code may be available, but was it
changed before the binary was compiled? I myself have been compiling
myself the software I use. Although I still don't have much experience
with it, there is a distribution which is based on you compiling the
packages, Gentoo [2].
- Be carefull with cloud services, for obvious reasons. (I don't use
them.)
- It is known that the NSA monitors and stores all communication
between servers located in the USA and the rest of the world. The web
address you mention below points to a server located in New Jersey,
therefore do not expect privacy in your communications with it.
- Not only servers located in the USA, but also any american company
and any foreign company doing business in the USA is subject to provide
information on their users, without their authorisation or even
knowledge, to american authorities. This can happen on request, but in
some cases it is known that they have automatic access to those
companies data.

It's a scary world the one we're moving to. That's why it is so
important to support the Free Software Foundation and in particular for
us Europeans the FSFEurope.

Fernando

[1] https://www.gnu.org/distros/free-distros.html
[2] https://www.gentoo.org/

Post by ilias.k.cs
Hello and thank you for your efforts,
I'm a software developer from Greece. With the Snowden leaks, my worst suspicions seem to be true.Ever since then, I've been trying to replace all of "my" proprietary software with free software (and all of the services and formats I've been using with free equivalents).
It was very easy to commit to this decision as I know that with free software I can do everything I did before and in many cases better.
However, its realization can be a little tricky sometimes, as for every software package (and format or service) I'm interested in, I've got to make certain that it is actually free.
Being open-sourced or licensed under a permissive license, even under GPL, is ofcourse a good pointer but does not seem enough, as for example Linux itself contains blobs.
Checking at the fsf directory for the package is something I always do, but if is not there, this doesn't mean it's not free.
And for formats, I mostly check FSF and Wikipedia.
As you know, services make the situation much more complex. For example, I'm interested in distance learning and MOOC services like http://www.complexityexplorer.org/ are a gigantic temptation for me. But I want to know what systems are being communicated when I make a request to such a service.
EdX is open sourced under AGPL, but is this enough for me to know?
In short, how can I know what a system I am using actually does, in a legal way, besides sticking to the systems I know for certain that are free? How do we deal with uncertainty?
Many thanks and sorry for the long post.
Ilias K.
_______________________________________________
Discussion mailing list
Discussion at fsfeurope.org
https://mail.fsfeurope.org/mailman/listinfo/discussion

[Hugo Roy]

Post by ilias.k.cs
In short, how can I know what a system I am using actually does, in a legal way, besides sticking to the systems I know for certain that are free? How do we deal with uncertainty?

I am not sure I have understood your question. But as far as
knowing "in a legal way" what?s going on, I would say that there?s
not much to worry about, as a user, than if it is a free
software/open source license or not.

GNU.org maintains a list of free software licenses:
http://www.gnu.org/licenses/license-list.html
(this is roughly the same list as the list of open source licenses
maintained by OSI).

Of course, there are many other issues to worry about:

- does it use open standards? see http://fsfe.org/activities/os/
- is it spying/tracking?
- is it possible to run it on your own server?

etc.
--
Hugo Roy, Free Software Foundation Europe, <www.fsfe.org>
Deputy Coordinator, FSFE Legal Team, <www.fsfe.org/legal>
Coordinator, FSFE French Team, <www.fsfe.org/fr>

Support Free Software, sign up! <https://fsfe.org/support>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 490 bytes
Desc: not available
URL: <http://mail.fsfeurope.org/pipermail/discussion/attachments/20140106/a91c53ef/attachment.pgp>