Hi. On Mon, Jun 08, 2020 at 06:25:57PM +0200, to...@tuxteam.de wrote: > On Mon, Jun 08, 2020 at 05:28:06PM +0300, Reco wrote: > > Hi. > > > > On Mon, Jun 08, 2020 at 02:17:27PM +0100, John ff wrote: > > > A local member of the LUG here built jitsi from sources and he is not > > > an IT professional. From that I infer that it is possible. > > > > I will assume > ^^^^^^ > Aha.
OP lacked the details, it's all we can do - to assume and to guess. > > 4) Possible (too lazy to check it) arbitrary file downloads during the > ^^^^^^^^^^^^^^^^^^^^ > I think it's a bit unfair to state such assumptions without really > checking in-depth. Point taken. I'm still lazy to check it out, so disregard this one. > I've had a look at the jitsi-desktop environment, and the couple > of .jar I saw are more or less standard Java components. No. They are just called like that. One should not trust the contents of those jars more than the random executable from the nearest warez dump. There's also a matter of bundled *so files. > A clean Debian packaging would try to replace those components by > library packages to depend on. And so on. No. A proper Debian packaging *must* replace all blobs that come with the source, unless maintainer is content with the package ending in non-free archive. Either it can be built from the source from the bottom to the top or it's non-DFSG compliant. Simple as that. > But jumping to the conclusion that the thing is "not really free" > is a big jump to do. I'm merely applying Debian policy to the build process here, and I even did not applied all of it. > And saying that "non-professionals" (what's this, anyway?) can't do > this is downright wrong. Nope. It takes a professional to distinguish barely outlined upstream "build process" from a proper one, and it takes it again to follow a proper process. Nobody requires that from the beginner, of course, these things can be learned, but learning them takes time and effort. What's really wrong is to mistake a zip archive full of blobs which should be built with non-free toolset with the proper libre source tarball which should built with libre tools. But then again, it's Java we're talking about here, and living in proprietary ecosystem breeds strange habits. Reco