Re: [GNU-linux-libre] [PATCH] gnu: Add ungoogled-chromium.

[Donald Robertson]

On 2/21/19 4:22 AM, Giovanni Biscuolo wrote:
> Hello all,
> 
> I really appreciate the efforts of everyone involved in checking
> possible FSDG issues in Guix ungoogled-chromium, seriuosly
> 
> anyway I find this thread is way too long to be useful in addressing
> FSDG issues in that package, so they can be **tacked** and 
> **referenced** properly
> 
> I humbly invite anyone finding _specific_ issues to file a bug to
> bug-g...@gnu.org, as I did myself here
> http://issues.guix.info/issue/34605 (forwarding one behalf of Luke
> report)
> 
> this will be my last message in this thread
> 

Yes, please do file bugs with the projects where appropriate. I know we
can get caught up in discussions here but
 is still the proper path
for fixing freedom issues.

Although I'm seeing that it looks like the link for Guix there doesn't
actually point clearly to how people can file bugs, but I'll get that fixed.

-- 
Donald R. Robertson, III, J.D.
Licensing & Compliance Manager
Free Software Foundation
51 Franklin Street, Fifth Floor
Boston, MA 02110
Phone +1-617-542-5942
Fax +1-617-542-2652 ex. 56

Re: [GNU-linux-libre] [PATCH] gnu: Add ungoogled-chromium.

[bill-auger]

On Wed, 20 Feb 2019 23:10:35 +0100 Marius wrote:
> Do you feel that I have not been cooperative?

well, kinda - i have never built a guix package before, or read any
guix packaging scripts; and i fully admit that i have not looked at it
yet - i was assuming that anyone interested will need to learn this new
trick before we could even begin to discuss your work, let alone
evaluate it

are guix packaging scripts really so self-explanatory that there is
zero learning curve? - we are all busy with our things, and not
everyone reading this list is comfortable reading scheme - some are not
even developers - i was really just hoping for a brief plain language
explanation

Re: [GNU-linux-libre] [PATCH] gnu: Add ungoogled-chromium.

[Giovanni Biscuolo]

Hello all,

I really appreciate the efforts of everyone involved in checking
possible FSDG issues in Guix ungoogled-chromium, seriuosly

anyway I find this thread is way too long to be useful in addressing
FSDG issues in that package, so they can be **tacked** and 
**referenced** properly

I humbly invite anyone finding _specific_ issues to file a bug to
bug-g...@gnu.org, as I did myself here
http://issues.guix.info/issue/34605 (forwarding one behalf of Luke
report)

this will be my last message in this thread

Marius Bakke  writes:

[...]

>> ;; Note: https://www.fsf.org/licensing/h264-patent-license:
>> "use_openh264=false"
>> "rtc_use_h264=false"
>
> I'm not an expert, so I'll defer judgement on this topic to someone more
> knowledgeable.  My understanding is that the OpenH264 library in use is
> sufficiently free.  Is that incorrect?

disclaimer: I'm not an expert and not at all knowledgeable :-)

but there's no need for an expert here: the link in the above note
substantially explains that H264 [1] is patent encumbered (thus not
patent-free), anyway GNU FSDG clearly states
https://www.gnu.org/distros/free-system-distribution-guidelines.en.html#patents

--8<---cut here---start->8---
we don't generally ask free system distributions to exclude software
because of possible threats from patents.
--8<---cut here---end--->8---

nonetheless, OpenH264 is free software, so I don't see any FSDG issue in
distributing it

all above said, I do not see FSDG issues in using H264 

HTH!
Giovanni



P.S.: I'm _not_ implying that patents are not a seriuos issue, but that
discussion is OT here :-S



[1] sorry to note the onviuos: it's a video compression format, not a
software (the software is OpenH264)

-- 
Giovanni Biscuolo

Xelera IT Infrastructures


signature.asc
Description: PGP signature

Re: [GNU-linux-libre] [PATCH] gnu: Add ungoogled-chromium.

[Marius Bakke]

Luke  writes:

> On 02/20/2019 05:10 PM, Marius Bakke wrote:
>> bill-auger  writes:
>>
>>> On Wed, 20 Feb 2019 15:50:02 +0100 Marius wrote:
 That message says we are no longer using a _fork_ of
 Ungoogled-Chromium. Earlier revisions of the patch was pulling from
 my repository[0], now we use the canonical upstream repository
 directly:
>>> but then what do you do to the upstream sources? - we all agree the
>>> upstream sources are not FSDG-free - arent the ungoogled patches the
>>> keystone of your liberation procedure?
>> The liberation procedure is right there in the package definition:
>>
>> .
>>
>> This script is what creates the FSDG-free source tarball presented to
>> users when they run `guix build --source ungoogled-chromium`.
>>
>>> that is entirely why i am confused now - it would help tremendously if
>>> you could tell us what you did to the upstream sources that you believe
>>> makes the FSDG-free - like a liberation recipe in plain english would
>>> be awseome
>> There are comments in the script.  Please ask if any of the steps are
>> unclear!  Improvements welcome.
>>
>
> Correct me if I'm wrong, but Widevine DRM and the ability to run
> proprietary codecs is still being built according to the provided
> package source?
> That's definitely a blocker.

Widevine is *not* built.  The ability to run proprietary codecs is
provided by the system "ffmpeg" library, thus it makes no sense for
Chromium to place additional restrictions on top of that.

> Some GN prefs missing from chromium.scm:
> ---
> ;; Disable non-free codecs
> "proprietary_codecs=false"
>
> ;; Disable DRM https://www.defectivebydesign.org
> "enable_widevine=false"

I explicitly disabled Widevine in this commit to prevent further
confusion:
.


> ;; Not XMPP compliant, walled-garden SaaSS:
> https://www.zdnet.com/article/google-moves-away-from-the-xmpp-open-messaging-standard/
> "enable_hangout_services_extension=false"

This option is disabled by default and (I believe) deprecated.

> ;; Note: https://www.fsf.org/licensing/h264-patent-license:
> "use_openh264=false"
> "rtc_use_h264=false"

I'm not an expert, so I'll defer judgement on this topic to someone more
knowledgeable.  My understanding is that the OpenH264 library in use is
sufficiently free.  Is that incorrect?


signature.asc
Description: PGP signature

Re: [GNU-linux-libre] [PATCH] gnu: Add ungoogled-chromium.

[Giovanni Biscuolo]

Hello Luke,

I'm replying _only_ about the DRM issue you reported

please consider there is an opened bug for this issue:
https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34565

for specific issues about DRM in Guix ungoogled-chromium package please
comment that bug including 34...@debbugs.gnu.org

...at least until is still open :-)

I'm not including 34...@debbugs.gnu.org because IMHO all your concerns
are well addressed in the bug report thread

Luke  writes:

[...]

> Correct me if I'm wrong, but Widevine DRM and the ability to run
> proprietary codecs is still being built according to the provided
> package source?

no

> That's definitely a blocker.
>
> While completely removing the DRM ability and creating a clean source
> tarball is optimal, it should at minimum be disabled at compile time to
> protect users.

https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34565#58

--8<---cut here---start->8---
For DRM to work, the user has to build with "enable_widevine=true", and
then somehow obtain 'libwidevinecdm.so' and make the browser use it.
--8<---cut here---end--->8---

this means that DRM *is* disabled at compile time and _also_ that
libwidevinecdm.so is not included in Guix ungoogled-chromium source

[...]

Thanks!
Giovanni

-- 
Giovanni Biscuolo

Xelera IT Infrastructures


signature.asc
Description: PGP signature

Re: [GNU-linux-libre] [PATCH] gnu: Add ungoogled-chromium.

[Jason Self]

On Wed, 2019-02-20 at 19:37 -0500, Luke wrote:
> Additionally, the patches are expected to be ran against specific
> Chromium releases. Future releases of Chromium are not
> patched/audited
> yet by the ungoogled-chromium project and may leak to Google.
> See: https://github.com/Eloston/ungoogled-chromium/releases
> 
> The Guix package is building against Chromium 72.0.3626.109 whereas
> the latest release of Ungoogled-Chromium as of this moment is for
> 72.0.3626.96-1.

Ah I had missed this. Thank you for catching that. 

If Guix is going to use ungoogled-chromium not only as a way to remove
privacy problems but also to fix freedom problems (although it's not
clear to me that ungoogled-chromium actually solves all of the freedom
problems in the first place; an audit will need to be done) then they
will need to be limited to whatever releases ungoogled-chromium
provides, and updated only in lockstep with each other lest other
unknown freedom problems creep in due to not having been
reviewed/audited by the people behind ungoogled-chromium.

signature.asc
Description: This is a digitally signed message part

Re: [GNU-linux-libre] [PATCH] gnu: Add ungoogled-chromium.

[Luke]

On 02/20/2019 05:10 PM, Marius Bakke wrote:
> bill-auger  writes:
>
>> On Wed, 20 Feb 2019 15:50:02 +0100 Marius wrote:
>>> That message says we are no longer using a _fork_ of
>>> Ungoogled-Chromium. Earlier revisions of the patch was pulling from
>>> my repository[0], now we use the canonical upstream repository
>>> directly:
>> but then what do you do to the upstream sources? - we all agree the
>> upstream sources are not FSDG-free - arent the ungoogled patches the
>> keystone of your liberation procedure?
> The liberation procedure is right there in the package definition:
>
> .
>
> This script is what creates the FSDG-free source tarball presented to
> users when they run `guix build --source ungoogled-chromium`.
>
>> that is entirely why i am confused now - it would help tremendously if
>> you could tell us what you did to the upstream sources that you believe
>> makes the FSDG-free - like a liberation recipe in plain english would
>> be awseome
> There are comments in the script.  Please ask if any of the steps are
> unclear!  Improvements welcome.
>

Correct me if I'm wrong, but Widevine DRM and the ability to run
proprietary codecs is still being built according to the provided
package source?
That's definitely a blocker.

While completely removing the DRM ability and creating a clean source
tarball is optimal, it should at minimum be disabled at compile time to
protect users.

Some GN prefs missing from chromium.scm:
---
;; Disable non-free codecs
"proprietary_codecs=false"

;; Disable DRM https://www.defectivebydesign.org
"enable_widevine=false"

;; Not XMPP compliant, walled-garden SaaSS:
https://www.zdnet.com/article/google-moves-away-from-the-xmpp-open-messaging-standard/
"enable_hangout_services_extension=false"

;; Note: https://www.fsf.org/licensing/h264-patent-license:
"use_openh264=false"
"rtc_use_h264=false"
---

Cleaning these modules properly would involve patching them out
completely and providing the cleaned tarball for end-users to compile.
Ungoogled-Chromium does remove the majority of Google SaaSS during the
patch process, but does not currently try to reach FSF compliance by
removing any of these proprietary anti-features or providing a cleaned
tree.

Additionally, the patches are expected to be ran against specific
Chromium releases. Future releases of Chromium are not patched/audited
yet by the ungoogled-chromium project and may leak to Google.
See: https://github.com/Eloston/ungoogled-chromium/releases

The Guix package is building against Chromium 72.0.3626.109 whereas the
latest release of Ungoogled-Chromium as of this moment is for
72.0.3626.96-1.



signature.asc
Description: OpenPGP digital signature

Re: [GNU-linux-libre] [PATCH] gnu: Add ungoogled-chromium.

[Marius Bakke]

bill-auger  writes:

> On Wed, 20 Feb 2019 15:50:02 +0100 Marius wrote:
>> now we use the canonical upstream repository
>
> maybe im just confused about those words - this "canonical upstream
> repository" i assumed meant the chromium upstream repository - i was
> under the impression that "ungoogled" was just a set of scripts or
> patches that must be run against the chromium source
>
> perhaps that is saying "ungoogled" is the "canonical upstream
> repository"? - but if there is no web browser source code in that
> repository, i would not consider that *the* upstream - chromium
> would be the canonical upstream, "ungoogled" is more like a
> third-party helper tool

Sorry for the confusion, canonical was probably the wrong choice of word
here.  The Ungoogled repository only contains scripts and patches
against the Chromium code base.

Earlier revisions of the Guix package used my "fork" of the Ungoogled
repository, that is no longer the case.


signature.asc
Description: PGP signature

Re: [GNU-linux-libre] [PATCH] gnu: Add ungoogled-chromium.

[Marius Bakke]

bill-auger  writes:

> On Wed, 20 Feb 2019 15:50:02 +0100 Marius wrote:
>> That message says we are no longer using a _fork_ of
>> Ungoogled-Chromium. Earlier revisions of the patch was pulling from
>> my repository[0], now we use the canonical upstream repository
>> directly:
>
> but then what do you do to the upstream sources? - we all agree the
> upstream sources are not FSDG-free - arent the ungoogled patches the
> keystone of your liberation procedure?

The liberation procedure is right there in the package definition:

.

This script is what creates the FSDG-free source tarball presented to
users when they run `guix build --source ungoogled-chromium`.

> that is entirely why i am confused now - it would help tremendously if
> you could tell us what you did to the upstream sources that you believe
> makes the FSDG-free - like a liberation recipe in plain english would
> be awseome

There are comments in the script.  Please ask if any of the steps are
unclear!  Improvements welcome.

> this audit would be an incredibly difficult task even with your full
> co-operation

I don't understand this statement.  We all know it's an extremely
difficult task.  I have done a large part of it and am glad that others
are joining in.  Do you feel that I have not been cooperative?


signature.asc
Description: PGP signature

Re: [GNU-linux-libre] [PATCH] gnu: Add ungoogled-chromium.

[bill-auger]

On Wed, 20 Feb 2019 15:50:02 +0100 Marius wrote:
> now we use the canonical upstream repository

maybe im just confused about those words - this "canonical upstream
repository" i assumed meant the chromium upstream repository - i was
under the impression that "ungoogled" was just a set of scripts or
patches that must be run against the chromium source

perhaps that is saying "ungoogled" is the "canonical upstream
repository"? - but if there is no web browser source code in that
repository, i would not consider that *the* upstream - chromium
would be the canonical upstream, "ungoogled" is more like a
third-party helper tool

sorry if i am confused here - i have never ungoogled anything myself,
and i am trying to understand the actual logistics of this

Re: [GNU-linux-libre] [PATCH] gnu: Add ungoogled-chromium.

[bill-auger]

On Wed, 20 Feb 2019 15:50:02 +0100 Marius wrote:
> That message says we are no longer using a _fork_ of
> Ungoogled-Chromium. Earlier revisions of the patch was pulling from
> my repository[0], now we use the canonical upstream repository
> directly:

but then what do you do to the upstream sources? - we all agree the
upstream sources are not FSDG-free - arent the ungoogled patches the
keystone of your liberation procedure?

that is entirely why i am confused now - it would help tremendously if
you could tell us what you did to the upstream sources that you believe
makes the FSDG-free - like a liberation recipe in plain english would
be awseome

this audit would be an incredibly difficult task even with your full
co-operation

Re: [GNU-linux-libre] [PATCH] gnu: Add ungoogled-chromium.

[Jason Self]

bill-auger wrote:
> the most recent news regarding this (what appears to be the official
> release notes) indicates that guix is no longer using the "ungoogled"
> team as an upstream[1]

I think that message "no longer using a fork of Ungoogled-Chromium"
means the opposite: Whereas they'd previously been using a modified
(aka "forked" version) now they're using upstream directly. Perhaps
upstream made some changes which made it more suitable for their
purposes.

Re: [GNU-linux-libre] [PATCH] gnu: Add ungoogled-chromium.

[Marius Bakke]

bill-auger  writes:

> however, now to add to the mystique, the most recent news regarding
> this (what appears to be the official release notes) indicates that guix
> is no longer using the "ungoogled" team as an upstream[1] - i have no
> idea what that implies; but it does appear to make the task of
> determining exactly what the guix chromium consist of, significantly
> more difficult

[...]

> [1]: https://lists.gnu.org/archive/html/guix-devel/2019-02/msg00367.html

That message says we are no longer using a _fork_ of Ungoogled-Chromium.
Earlier revisions of the patch was pulling from my repository[0], now we
use the canonical upstream repository directly:

.

[0] https://github.com/mbakke/ungoogled-chromium/tree/guix


signature.asc
Description: PGP signature

Re: [GNU-linux-libre] [PATCH] gnu: Add ungoogled-chromium.

[Donald Robertson]

On 2/16/19 2:47 PM, Adonay Felipe Nogueira wrote:
[snip]
> 
> As I said in a message to these mailing lists, I already started
> reviewing Chromium, although this project is big and I might not have
> the time nor all the skills to do it alone. Since today, I moved the
> review, which was available at [1], to the appropriate Review namespace
> at [2].
> 


Thank you for taking the time to do this review. The system we've set up
relies on the whole community to do the checking. It is not possible for
the distros (even aided by this mailing list), to review everything
exhaustively. Instead, we rely on reports that specify what the exact
freedom issue is. Obviously we can take it upon ourselves to sometimes
conduct these reviews, but we encourage everyone to participate by
filing bugs when they come across things
.
-- 
Donald R. Robertson, III, J.D.
Licensing & Compliance Manager
Free Software Foundation
51 Franklin Street, Fifth Floor
Boston, MA 02110
Phone +1-617-542-5942
Fax +1-617-542-2652 ex. 56

Re: [GNU-linux-libre] [PATCH] gnu: Add ungoogled-chromium.

[Donald Robertson]

On 2/16/19 8:39 PM, bill-auger wrote:
> On Sat, 16 Feb 2019 14:06:43 -0600 Brett wrote:
>> I think you can probably go ahead and push that patch
>> Bill,  What do you think here?
> 
> i think that would be intentionally creating exactly the same
> unpleasant situation as the pureos bug report that stood for many
> months, unaddressed
> 
> i think that IF this is the proper course of action, then we
> should apologize to pureos for asking them to remove it last year
> 
> but let me rephrase that more plainly:
> 
> if we do not FIRSTLY apologize to pureos for asking them to remove
> chromium and publicly endorse them to re-instate it, then endorsing it
> into guix would be hypocritical and shameful
> 
> 

>From this thread it seems like there were some legitimate issues that
the people at Guix have now addressed. Isn't this more a situation of
possibly changed circumstances?
-- 
Donald R. Robertson, III, J.D.
Licensing & Compliance Manager
Free Software Foundation
51 Franklin Street, Fifth Floor
Boston, MA 02110
Phone +1-617-542-5942
Fax +1-617-542-2652 ex. 56

Re: [GNU-linux-libre] [PATCH] gnu: Add ungoogled-chromium.

[Donald Robertson]

On 2/16/19 2:29 PM, Amin Bandali wrote:
>> I’ve attached a gzipped version of the above text file.
> 
> Sorry, hit send too soon.  I’ve attached it to this message.
> 

I just want to clarify something here. Not having proper license and
copyright headers on files within a project is not a bar to that program
being free software. If it was, we'd have to remove something on the
order of 80% of the Free Software Directory. It's obviously bad
practice, as it can create confusion, particularly if those files get
separated from the project. So we want people to fix that. But the
reality is that almost all the tickets I file with projects are about
missing headers because very few projects do it 100%.

If that's all we're seeing, then that in itself is not an issue in terms
of whether it can be in a fully free GNU/linux distro.


-- 
Donald R. Robertson, III, J.D.
Licensing & Compliance Manager
Free Software Foundation
51 Franklin Street, Fifth Floor
Boston, MA 02110
Phone +1-617-542-5942
Fax +1-617-542-2652 ex. 56

Re: [GNU-linux-libre] [PATCH] gnu: Add ungoogled-chromium.

[Donald Robertson]

On 2/17/19 9:06 AM, Julie Marchant wrote:
[snip]
> 
>> most importantly, i personally dont care to argue for nor against
>> chromium - i just want all FSDG distros to agree on how it should be
>> treated, regardless of what that entails
> 
> Why? Are you opposed to individual distros making their own individual
> decisions?
> 

Distros have to make decisions all the time about what software to
include, and we don't want to interfere with that. The system as it is
set up is such that the distros promise to respond to reports of freedom
issues and fix them when the report is valid.

We can obviously all work together to tag issues (as we've done here
).
But as noted before, some items on that list might not be up to date,
and obviously if someone has taken the time to address the issues then
we need to see about updating to reflect new possible fixes. Updating
that list involves discussion here on the mailing list and likely
approval from RMS as well.

Something being on the list isn't an automatic ban for a distro wanting
to include it. You can view it as an initial nonfree report that needs
to be addressed.

But if at the end of the day, something is determined to not meet the
guidelines, then that will have to be removed, or the distro can't
maintain it's promise. So no endorsed distros will be able to make a
different decision, though obviously as members of the list they are
involved in making that determination.

-- 
Donald R. Robertson, III, J.D.
Licensing & Compliance Manager
Free Software Foundation
51 Franklin Street, Fifth Floor
Boston, MA 02110
Phone +1-617-542-5942
Fax +1-617-542-2652 ex. 56

Re: [GNU-linux-libre] [PATCH] gnu: Add ungoogled-chromium.

[Simon Nielsen]

18.02.2019, 14:44, "Tobias Geerinckx-Rice" 
:
> If this is the quality of argument that ‘won’ over PureOS, it's
> blaming Guix/Ricardo for not being around to stop others from
> being bullied.
>
> Kind regards,
>
> T G-R

Hi Tobias,

I've been reading this conversation from the outside but noticed it seems to be 
shifting to a meta
rather than about the state of chromium itself so it would be nice if it went 
back on topic.
‌
Seeing as the issue here relates to being uncertain shouldn't upstream confirm 
which parts run
under what license in more detail? As I can tell so far this hasn't been done 
(unless I've missed
something) thus the current situation.

So the choice here is really about following the FSDG for now until it's 
revised or going against it
causing a split in the community around it. Guix would be in the right but 
depending on the result
there's a chance for a negative return (or a positive one). Are most here sure 
which direction it
will go? From just reading the snippets about PureOS they seemed to have gotten 
quite a bit of
flack until it was removed, won't the same happen to Guix?

I've enjoyed using Guix for a bit over a year now and will continue regardless 
of the outcome.

I apologize if this email is in conflict with the standard format as I usually 
don't engage in responding
to mailing lists so my interpretation of the desired style might not be as 
accurate as of yet.

Thank you

Simon Nielsen

Re: [GNU-linux-libre] [PATCH] gnu: Add ungoogled-chromium.

[Tobias Geerinckx-Rice]

bill-auger wrote:

On Sun, 17 Feb 2019 23:33:06 +0100 Ricardo wrote:
I don’t feel motivated to apologize to the people involved in 
PureOS
because I wasn’t around when they were pressured / convinced to 
drop

Chromium.


no, but you could have been around - you also could have argued 
for
pureos on their side of the debate, and perhaps won favor for 
chromium
at that time; so that none of us would need to be discussing it 
today,
nor ever again - but unfortunately, it is true, you did not do 
that -
so here we are today, raking this ugly old thing out of the mud 
once

again


If this is the quality of argument that ‘won’ over PureOS, it's 
blaming Guix/Ricardo for not being around to stop others from 
being bullied.


Kind regards,

T G-R

Re: [GNU-linux-libre] [PATCH] gnu: Add ungoogled-chromium.

[Denis 'GNUtoo' Carikli]

On Sat, 16 Feb 2019 12:16:41 +0100
Gábor Boskovits  wrote:

> It seems to me, that there is a whole bunch of people interested in
> this, but due to lack of resources or for some other reasons nothing
> is really happening. Do you know any we we could help getting this
> resolved?
This is a very good point.

I also wonder if at the end, working to fix the problem by reviewing
chromium source code more carefully would take less resources than
discussing endlessly on how to deal with the fact that the source code
hasn't been reviewed.

Denis.


pgpiN045HYdwh.pgp
Description: OpenPGP digital signature

Re: [GNU-linux-libre] [PATCH] gnu: Add ungoogled-chromium.

[bill-auger]

On Sun, 17 Feb 2019 23:33:06 +0100 Ricardo wrote:
> I don’t feel motivated to apologize to the people involved in PureOS
> because I wasn’t around when they were pressured / convinced to drop
> Chromium.

no, but you could have been around - you also could have argued for
pureos on their side of the debate, and perhaps won favor for chromium
at that time; so that none of us would need to be discussing it today,
nor ever again - but unfortunately, it is true, you did not do that -
so here we are today, raking this ugly old thing out of the mud once
again


On Sun, 17 Feb 2019 23:33:06 +0100 Ricardo wrote:
> In day to day Guix activities, we don’t ask developers of other
> distros that also happen to subscribe to the FSDG to reach consensus
> before making project decisions.  

of course every distro should have complete autonomy, especially for
decisions that only pertain to that one distro - i am only considering
the most fundamental decisions that obviously affect all distros
equally, and reflect upon the integrity of the FSDG itself, such as
which software is FSDG-free and which are not (and clarifying why or
why not, and ideally, offering specific guidance for acceptably
liberating the most common or troublesome ones) - if we can not all
agree on that single most central concern to the FSDG, then what
exactly is the value of the FSDG anyways?


On Sun, 17 Feb 2019 23:33:06 +0100 Ricardo wrote:
> You are suggesting that FSDG
> distros form a community beyond the sense that they abide by the same
> guidelines.  I don’t think that’s reflecting reality.  It’s another
> thing to discuss if this should be so.

yes - awesome!! - that is exactly what i have been proposing and
working toward for a long time - in this case, not as just "another
thing to discuss"; but it is *the* sole reason that i raised this issue
with guix at this time (last september actually[1])

i have repeated it over and over again, that i couldnt care less about
the chromium program, specifically - i want to discuss only and exactly
this: enticing all FSDG distros to collaborate toward the achievement
of common goals and solutions to common problems; as to avoid both
redundant efforts and the presenting of conflicting philosophies to
users, regarding the nature and essence of "free software" - the
chromium program is not itself a fundamental problem, but one, albeit
notorious, example of a common problem that affects all FSDG distros,
and has been addressed by the group for the purpose of presenting a
uniform message regarding it's FSDG status

it would be a beautiful thing to have vigorous cross-distro
collaboration as a focal point of the FSDG itself, very much in the
collaborative spirit of GNU; and i think that most of the distros are
already on board with that idea as a worthwhile plan, and have always
been participating on the FSDG mailing list under that presumption -
last year's re-structuring of the incoming distros community evaluation
process was a concrete step in that direction

"reality" is only what we make of it - if you see the FSDG as nothing
more than a trophy or badge that you earned once upon a time, a
milestone that need not be any concerned ever more after, then that
is the reality you will have - the FSF does not want to mandate that
anyone participate in the on-going group discussions; but it is a very
good idea to show that the FSDG distros behave as a community of
siblings by, at the very least, presenting a uniform stance on shared
freedom issues


On Sun, 17 Feb 2019 23:33:06 +0100 Ricardo wrote:
> I see no violation of the FSDG here.

that is not news, Ricardo - no one sees any obvious licensing violation
of the FSDG; not today, nor a year ago, nor five years ago - if there
were any known, they could have (and probably would have) been
addressed long ago, and maybe we would not be discussing this now - the
only clear FSDG problem today is the new one that guix is making for all
other distros that are trying to be compliant with the FSDG as it is
written, by intentionally doing something that is explicitly against
the written recommendation - the "as it is written" part is perhaps
dubious; but it is the keystone of a long-standing FSDG anomaly, and
guix is in a very good position to help resolve that once and for all,
for the benefit of all

whether anyone likes it or not, adding chromium into any FSDG distro
today, is in direct conflict with that pesky: "what is written" - the
solution is almost certainly, that it needs to be re-written; but there
is not yet anything to over-write it with - "i see no problem" is
clearly not sufficient - we all know it has FSDG problems; and the
current wording will remain until someone who cares about chromium
offers a convincing liberation procedure to replace it as the FSDG
recommendation

we are asking for your help with this, for the benefit of all FSDG
distros and their users, present and future, because it is only guix
that claims to have any new information about 

Re: [GNU-linux-libre] [PATCH] gnu: Add ungoogled-chromium.

[bill-auger]

On Sun, 17 Feb 2019 09:06:20 -0500 Julie wrote:
> So... the same thing as Linux.

yes, much the same situation as linux, but with the very important
difference, that we have people like the good folks at linux-libre who
are constantly watching linux for new undesirables entering it, and
those people are actively and routinely removing anything non-free - no
such thing is happening for web browsers - no one is even watching


On Sun, 17 Feb 2019 09:06:20 -0500 Julie wrote:
> Are you saying, then, that we are specifically aware of proprietary
> software in ungoogled-chromium? Have stated what that proprietary
> software is?

i am saying that i am not aware of anyone making any such accusations
of non-free software being in that browser - but we are painfully aware
of the accusations against chromium, and it is sitting "on the table";
so we are very unfortunately compelled to address it - thats all

i am not personally wedded to any preference on *how* we should address
it; but we should address it

if ever someone raises the same concern with firefox, then we will be
compelled to address that, when or if that unfortunate day comes;
because that is exactly what the FSDG is for: to determine which
software is fit for free distribution, and which is not


On Sun, 17 Feb 2019 09:06:20 -0500 Julie wrote:
> Why? Are you opposed to individual distros making their own individual
> decisions?

not all "decisions" - only the most crucial and obvious decisions like
this one, regarding exactly what is "free software" and what is not
"free software" - because if we can not agree on what is and is not
"free software", then the term "free software" is meaningless, and
hence a FSDG-free distro is a pointless distinction

Re: [GNU-linux-libre] [PATCH] gnu: Add ungoogled-chromium.

[Ricardo Wurmus]

bill-auger  writes:

> if we do not FIRSTLY apologize to pureos for asking them to remove
> chromium and publicly endorse them to re-instate it, then endorsing it
> into guix would be hypocritical and shameful

I find this use of “we” confusing.

I don’t feel motivated to apologize to the people involved in PureOS
because I wasn’t around when they were pressured / convinced to drop
Chromium.  I don’t know if any of the regular Guix contributors have.

In day to day Guix activities, we don’t ask developers of other distros
that also happen to subscribe to the FSDG to reach consensus before
making project decisions.  You are suggesting that FSDG distros form a
community beyond the sense that they abide by the same guidelines.  I
don’t think that’s reflecting reality.  It’s another thing to discuss if
this should be so.

With regards to the Chromium upstream bug report about the license
script and the suggestion that upstream doesn’t know what license their
code has, I’m satisfied with this comment:

   https://bugs.chromium.org/p/chromium/issues/detail?id=28291#c31

The script appears to be not very successful in detecting valid license
declarations in third party code.  FWIW, in my opinion it would be
unreasonable to further delay Marius’s work from becoming part of Guix.
I see no violation of the FSDG here.

--
Ricardo

Re: [GNU-linux-libre] [PATCH] gnu: Add ungoogled-chromium.

[Christopher Lemmer Webber]

Julie Marchant writes:

> I don't understand what's so complicated about this issue. In justice
> systems, we adopt an "innocent until proven guilty" system because you
> can't really prove innocence, only guilt.

I agree with Julie's point here.  The fear that "there might be
something nonfree in there"... well, that's true for our entire system.
We also have a similar issue with security vulnerabilities... there are
almost certainly security vulnerabilities in the sum total of our
packages.  Which packages though?  And what are they?  We don't know the
answer to either of those.  Our response is to take action if and when
problems are found.  That's the same approach we should take here.

 - Chris

Re: [GNU-linux-libre] [PATCH] gnu: Add ungoogled-chromium.

[Julie Marchant]

On 02/17/2019 02:43 AM, bill-auger wrote:
> the difference there is that chromium is not one piece of software
> written by one person or even one modestly sized team - it is a
> conglomeration of perhaps 100s of different projects written by perhaps
> 1000s of authors - for some files, it may not actually be known who the
> author is, never mind which license they chose, or when - the word
> "trust" comes into play there, because it is not clear that any one
> single person on the chromium team can honestly account for everything
> in the code-base, much less to authoritatively vouch for all of the
> authors and various licensing

So... the same thing as Linux. And many stores, for that matter. On that
note...

> per your analogy, this is more like the owners of one building giving
> you permission to go anywhere in the city, because they believe that
> every other building in the city shares their trespassing policy -
> though, they can not themselves, demonstrate that they have precise
> knowledge of the exact number of buildings in the city, nor who their
> owners are, nor their owners' trespassing policies

You do know many stores don't own everything in the building, right?
Lots of machinery is owned by third parties such as vendors; coolers
holding drinks, for example, are typically owned and stocked by vendors
such as Coca-Cola and Pepsi. In the Walmart I work at, there's even a
separate business in the exact same building whose area is either owned
or leased by them (I don't know which). Plus, all stores have sections
where customers are not allowed to go (indicated by signs). So no, the
analogy is exactly the same. You see that a door says "Employees Only"
and don't enter; you don't go asking for proof that you can walk
throughout every inch of the store that you seem to have implicit
permission to walk through.

> o/c someone could probably raise exactly the same doubts about mozilla -
> luckily for us though, we are not aware of any, and so are not yet so
> uncomfortably compelled to address them

Are you saying, then, that we are specifically aware of proprietary
software in ungoogled-chromium? Have stated what that proprietary
software is?

After all, if you aren't aware of proprietary software in
ungoogled-chromium, this would seem to be special pleading. Am I wrong?

> most importantly, i personally dont care to argue for nor against
> chromium - i just want all FSDG distros to agree on how it should be
> treated, regardless of what that entails

Why? Are you opposed to individual distros making their own individual
decisions?

-- 
Julie Marchant
http://onpon4.github.io

Encrypt your emails with GnuPG:
https://emailselfdefense.fsf.org

Re: [GNU-linux-libre] [PATCH] gnu: Add ungoogled-chromium.

[bill-auger]

the difference there is that chromium is not one piece of software
written by one person or even one modestly sized team - it is a
conglomeration of perhaps 100s of different projects written by perhaps
1000s of authors - for some files, it may not actually be known who the
author is, never mind which license they chose, or when - the word
"trust" comes into play there, because it is not clear that any one
single person on the chromium team can honestly account for everything
in the code-base, much less to authoritatively vouch for all of the
authors and various licensing

it is a more reasonable argument to make for projects with a much,
much fewer number of files and many, many fewer devs; but i think a
program this size is far beyond the benefit of reasonable doubt - and,
of course, on the other hand, if the project had many fewer files and
many fewer devs, then a comprehensive audit would not be as absurdly
difficult - so i think that is a moot point in this case

per your analogy, this is more like the owners of one building giving
you permission to go anywhere in the city, because they believe that
every other building in the city shares their trespassing policy -
though, they can not themselves, demonstrate that they have precise
knowledge of the exact number of buildings in the city, nor who their
owners are, nor their owners' trespassing policies

o/c someone could probably raise exactly the same doubts about mozilla -
luckily for us though, we are not aware of any, and so are not yet so
uncomfortably compelled to address them

most importantly, i personally dont care to argue for nor against
chromium - i just want all FSDG distros to agree on how it should be
treated, regardless of what that entails

if we can not all agree on how to interpret the FSDG, and apply it
uniformly to all distro, then the FSDG endorsement has no value and the
FSDG work-group serves no meaningful purpose to the world - we may as
well just go our own separate ways, and satisfy our own individual
fancies

that is what is truly at stake here - not this particular: "yet another
web browser"

Re: [GNU-linux-libre] [PATCH] gnu: Add ungoogled-chromium.

[Julie Marchant]

On 02/16/2019 09:42 PM, bill-auger wrote:
> Julie -
> 
> that was all just a long winded re-statement of the "we should always
> trust the upstream blindly" argument - i think the Great Wise Old Gnu
> would conclude that is a very unwise general policy; and especially
> unwise when that particular upstream is well-known for its code being
> non-FSDG free

Just to repeat the disclaimer, I'm not a lawyer and none of this is
legal advice.

I don't see why you're bringing "trust" into this. I've been trying to
argue that it has nothing to do with the issue. If the copyright holder
of a work says you're allowed to use it under X conditions, you are.
There's no "trust" there. You can't say that someone is allowed to do X
and then claim later that they weren't *really* allowed to do X.

I feel like I already gave this analogy at some point, but it's like
your "trust" that Walmart permits you to enter the store and shop. You
don't demand proof that you're allowed to shop at Walmart; it's implied
by the fact that the doors are unlocked and the building is enticing you
to go in. Similarly, Walmart can't just retroactively claim you weren't
really allowed in, even though you obviously were, and have you arrested
for trespassing. No, because of the conditions, if a Walmart wants to
keep you out, you have to be specifically told that you're not welcome.
They can't just call the police one day and have you arrested for
trespassing. Ergo, you don't need "trust".

The same sort of thing would apply to a licensing situation like this.
If the Chromium team says that Chromium is under the Modified BSD
License, then it *is* under the Modified BSD License, unless a
particular file says otherwise. The same applies to ungoogled-chromium
and its maintainer.

-- 
Julie Marchant
http://onpon4.github.io

Encrypt your emails with GnuPG:
https://emailselfdefense.fsf.org

Re: [GNU-linux-libre] [PATCH] gnu: Add ungoogled-chromium.

[bill-auger]

On Sat, 16 Feb 2019 14:34:38 -0200 Alexandre wrote:
> Maybe you have actually completed the steps that were missing in the
> auditing or Chromium to conclude it's Free, or at least some of the
> remaining tasks can be checked off.

that would be something wonderful, indeed

nothing would please me more at this time than to declare chromium as
FSDG-free, to finally put this controversy behind us in the past, and
never to speak of chromium nor qt5-webengine nor electron again - never
again to devote precious time liberating and re-packaging yet another
KDE program, for such a trivial reason as the frivolous presumption,
that the year 2019, demands their 20 year old system monitor GUI to
embed it's own web browser

im not making this up - the 'kde-plasma-desktop' became un-installable
on parabola this week, for exactly that reason

it should not be surprising that most have been satisfied thus far, to
throw this insidious chromiumm/webengine/electron thing under the bus
and move on; but it cant stay that way forever - at some point, a real
solution will be imperative, as this "javascript-on-the-desktop" trend
continues to infect the system

Re: [GNU-linux-libre] [PATCH] gnu: Add ungoogled-chromium.

[bill-auger]

Julie -

that was all just a long winded re-statement of the "we should always
trust the upstream blindly" argument - i think the Great Wise Old Gnu
would conclude that is a very unwise general policy; and especially
unwise when that particular upstream is well-known for its code being
non-FSDG free

Re: [GNU-linux-libre] [PATCH] gnu: Add ungoogled-chromium.

[Julie Marchant]

On 02/16/2019 08:37 PM, bill-auger wrote:
> On Sat, 16 Feb 2019 09:18:58 -0500 Julie wrote:
> yes they have - the original bug report noted several; and those were
> said to be fixed

Ah, perfect. Then the problem is solved, no? Those issues, as you say,
were fixed by the Chromium team (according to them, and since you don't
point to evidence that the problems remain, I assume that means they
don't), and the Ungoogled-Chromium project has apparently fixed all
other problems. Unless you are aware of another unaddressed problem,
that is.

> there is a huge difference with this (and i have already made this
> clear, BTW) - the default state for copyright is not "innocent" - the
> default state is "no permission granted" - according to this analogy,
> software is guilty until proven innocent under the existing copyright
> laws - that is not something we can decide to re-interpret

I already responded to this, but it appears it went past your radar for
some reason, or perhaps I just didn't make myself clear enough, so let
me restate it. I'll be talking about how copyright works, so let me just
state upfront that I'm not a lawyer and no one should take this as legal
advice.

Copyright is based on declarations. That is, when someone declares that
you are allowed to do something, as long as they are the rightful
copyright holder, you are allowed to do that thing. It's the same sort
of deal as any other permission you might have to get from someone else.
So what you need is proof of such a declaration of permission. That's
what license statements are for.

So looking at the Chromium source code tree, we see a number of text
files. Of particular note, you see a file called "LICENSE", which is
simply a copy of the Modified BSD License. It doesn't specify what files
it applies to, and obviously, there are files it doesn't. But the fact
that they label it this way strongly implies that Chromium is generally
speaking under that license. And when you look through files, that
assumption is reaffirmed with statements that look like this:

// Copyright 2017 The Chromium Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

So given this, any differently-licensed file would be an exception, and
it would be very easy to point these exceptions out and then fix them.
The same is true of Linux, by the way, and apparently there was no
problem simply identifying proprietary pieces and removing them.

Hence, I think, if someone says they've produced a version of Chromium
with all freedom-related problems solved, and no one has any evidence to
the contrary, that version of Chromium should be accepted.

-- 
Julie Marchant
http://onpon4.github.io

Encrypt your emails with GnuPG:
https://emailselfdefense.fsf.org

Re: [GNU-linux-libre] [PATCH] gnu: Add ungoogled-chromium.

[bill-auger]

On Sat, 16 Feb 2019 17:33:21 +0100 Marius wrote:
> Do we have
> any reason to distrust what's written in the LICENSE file?  

based on your own account, you very explicitly distrust the code
released by those authors in terms of privacy - so why would you
implicitly trust it in terms of licensing - there seems to be a
disjunct in logic there

Re: [GNU-linux-libre] [PATCH] gnu: Add ungoogled-chromium.

[bill-auger]

On Sat, 16 Feb 2019 14:06:43 -0600 Brett wrote:
> I think you can probably go ahead and push that patch
> Bill,  What do you think here?

i think that would be intentionally creating exactly the same
unpleasant situation as the pureos bug report that stood for many
months, unaddressed

i think that IF this is the proper course of action, then we
should apologize to pureos for asking them to remove it last year

but let me rephrase that more plainly:

if we do not FIRSTLY apologize to pureos for asking them to remove
chromium and publicly endorse them to re-instate it, then endorsing it
into guix would be hypocritical and shameful

Re: [GNU-linux-libre] [PATCH] gnu: Add ungoogled-chromium.

[bill-auger]

On Sat, 16 Feb 2019 09:18:58 -0500 Julie wrote:
> In justice
> systems, we adopt an "innocent until proven guilty" system because you
> can't really prove innocence, only guilt.   

i wondered if someone would bring that up - 

there is a huge difference with this (and i have already made this
clear, BTW) - the default state for copyright is not "innocent" - the
default state is "no permission granted" - according to this analogy,
software is guilty until proven innocent under the existing copyright
laws - that is not something we can decide to re-interpret


On Sat, 16 Feb 2019 09:18:58 -0500 Julie wrote:
> As far as I know, and correct
> me if I'm wrong here, no one in the entire history of this claim  

yes they have - the original bug report noted several; and those were
said to be fixed


On Sat, 16 Feb 2019 09:18:58 -0500 Julie wrote:
> this, though, then it seems to me that the correct action to take
> would be to address that issue, if not upstream, then in a fork.  
 
i agree - at the very least, i would to see that original bug report
closed by the upstream - its continued presence is looms ominously and
dubiously

Re: [GNU-linux-libre] [PATCH] gnu: Add ungoogled-chromium.

[Brett Gilio]

Brett Gilio writes:

> Adonay Felipe Nogueira writes:
>
>> Em 16/02/2019 12:18, Julie Marchant escreveu:
>>> libre? The only argument I've seen on the matter is the way copyright
>>> works, but Chromium is under the Modified BSD License according to
>>> documentation I was able to find. If some files are not actually covered
>>
>> For what is worth, what I learned with projects that don't follow the
>> Open Source Definition (I know that I shouldn't support this term here,
>> but I had to mention it) is that they mask their non-compliance behind a
>> license. Of course we don't intend to foster open source here, as this
>> project, having the goal to provide a package manager that is under the
>> GNU project, also aims to create a system distribution that follows the
>> GNU FSDG and uses such package manager
>>
>> If the norm would be to only check the licenses, then we would have for
>> example, taken ages to figure out that the kernel source files from
>> upstream of GNU Linux-libre was/is non-free.
>>
>> Having a requirement for a package to be first throughly reviewed
>> eliminates some of the possibility of having non-free functional data or
>> non-distributable non-functional data. It's not a perfect protection
>> (since the package in review might have implemented things from other
>> works that one of the reviewers might not be aware of).
>>
>> As I said in a message to these mailing lists, I already started
>> reviewing Chromium, although this project is big and I might not have
>> the time nor all the skills to do it alone. Since today, I moved the
>> review, which was available at [1], to the appropriate Review namespace
>> at [2].
>>
>>
>> [1] https://directory.fsf.org/wiki/Talk:Chromium
>> [2] https://directory.fsf.org/wiki/Review:Chromium-REV-ID-1
>
> Adonay, thank you for taking the initiative here! I think this is a
> needed step forward.
>
> Brett Gilio

Also, maybe it would be of some help to involve somebody from the FSF to
be a neutral mediator on this process until we come to some reasonable
conclusion?

Marius,

I think you can probably go ahead and push that patch, knowing full well
that Bill warned a bug report will be filed against the Guix source tree
until such time that an audit concludes or Adonay's suggestion is
followed through with.

Bill,

What do you think here?

Brett Gilio

Re: [GNU-linux-libre] [PATCH] gnu: Add ungoogled-chromium.

[Brett Gilio]

Adonay Felipe Nogueira writes:

> Em 16/02/2019 12:18, Julie Marchant escreveu:
>> libre? The only argument I've seen on the matter is the way copyright
>> works, but Chromium is under the Modified BSD License according to
>> documentation I was able to find. If some files are not actually covered
>
> For what is worth, what I learned with projects that don't follow the
> Open Source Definition (I know that I shouldn't support this term here,
> but I had to mention it) is that they mask their non-compliance behind a
> license. Of course we don't intend to foster open source here, as this
> project, having the goal to provide a package manager that is under the
> GNU project, also aims to create a system distribution that follows the
> GNU FSDG and uses such package manager
>
> If the norm would be to only check the licenses, then we would have for
> example, taken ages to figure out that the kernel source files from
> upstream of GNU Linux-libre was/is non-free.
>
> Having a requirement for a package to be first throughly reviewed
> eliminates some of the possibility of having non-free functional data or
> non-distributable non-functional data. It's not a perfect protection
> (since the package in review might have implemented things from other
> works that one of the reviewers might not be aware of).
>
> As I said in a message to these mailing lists, I already started
> reviewing Chromium, although this project is big and I might not have
> the time nor all the skills to do it alone. Since today, I moved the
> review, which was available at [1], to the appropriate Review namespace
> at [2].
>
>
> [1] https://directory.fsf.org/wiki/Talk:Chromium
> [2] https://directory.fsf.org/wiki/Review:Chromium-REV-ID-1

Adonay, thank you for taking the initiative here! I think this is a
needed step forward.

Brett Gilio

Re: [GNU-linux-libre] [PATCH] gnu: Add ungoogled-chromium.

[Adonay Felipe Nogueira]

Em 16/02/2019 12:18, Julie Marchant escreveu:
> libre? The only argument I've seen on the matter is the way copyright
> works, but Chromium is under the Modified BSD License according to
> documentation I was able to find. If some files are not actually covered

For what is worth, what I learned with projects that don't follow the
Open Source Definition (I know that I shouldn't support this term here,
but I had to mention it) is that they mask their non-compliance behind a
license. Of course we don't intend to foster open source here, as this
project, having the goal to provide a package manager that is under the
GNU project, also aims to create a system distribution that follows the
GNU FSDG and uses such package manager

If the norm would be to only check the licenses, then we would have for
example, taken ages to figure out that the kernel source files from
upstream of GNU Linux-libre was/is non-free.

Having a requirement for a package to be first throughly reviewed
eliminates some of the possibility of having non-free functional data or
non-distributable non-functional data. It's not a perfect protection
(since the package in review might have implemented things from other
works that one of the reviewers might not be aware of).

As I said in a message to these mailing lists, I already started
reviewing Chromium, although this project is big and I might not have
the time nor all the skills to do it alone. Since today, I moved the
review, which was available at [1], to the appropriate Review namespace
at [2].


[1] https://directory.fsf.org/wiki/Talk:Chromium
[2] https://directory.fsf.org/wiki/Review:Chromium-REV-ID-1



signature.asc
Description: OpenPGP digital signature

Re: [GNU-linux-libre] [PATCH] gnu: Add ungoogled-chromium.

[Amin Bandali]

Marius,

On 2019-02-16  5:33 PM, Marius Bakke wrote:

[...]

>
> Can you point out one or more files with an unclear license?  Do we have
> any reason to distrust what's written in the LICENSE file?
>

I don’t have a direct example of one such file off top of my head, but
looking at the large reported chromium issue[1], I see there are a
number of open blocking issues linked to that one.  Also, I was looking
at [2] and [3] from a little over a year ago, which included the results
of running licensecheck on the chromium tree, but I wasn’t able to
download any of the resulting txt files there.  So I thought I’d clone a
fresh copy of chromium and run licensecheck from the Debian Stretch repo
on all the files as follows:

git clone --depth 1 https://chromium.googlesource.com/chromium/src.git
cd src
git rev-parse HEAD  # result: eda06a0b859a08d15a1ab6a6850e42e667530f0b
licensecheck -c '.*' -r * > ../licensecheck-chromium-eda06a0b859a.txt

I’ve attached a gzipped version of the above text file.  Granted, there
are caveats: firstly, that the above invocation of licensecheck examines
/all/ of the files in the repo, including test html files which are not
relevant and should be filtered out; and secondly, the output contains a
very large number of “UNKNOWN” results which may be false positives.

Link [3] mentioned running FSD Script Aid on the chromium tree as well,
but I don’t have enough time at the moment to do so.

Hope this is of some help.

[1]: https://bugs.chromium.org/p/chromium/issues/detail?id=28291
[2]: https://lists.gnu.org/r/directory-discuss/2017-11/msg00014.html
[3]: https://directory.fsf.org/wiki/Talk:Chromium

Best,
amin

Re: [GNU-linux-libre] [PATCH] gnu: Add ungoogled-chromium.

[Marius Bakke]

Alexandre Oliva  writes:

> On Feb 16, 2019, Marius Bakke  wrote:
>
>> Despite years of searching, I have not found any proprietary parts in
>> first party code!
>
> Could you please summarize what you did in your searching?
>
> Maybe you have actually completed the steps that were missing in the
> auditing or Chromium to conclude it's Free, or at least some of the
> remaining tasks can be checked off.

I'm afraid I don't have a good summary.  I have grepped for certain
keywords and looked for LICENSE-like files, sanity checked many
different parts of the source...  Much like I do for any Guix package,
only going over the course of years.  Are there any concrete tasks that
that I can look at and check off?


signature.asc
Description: PGP signature

Re: [GNU-linux-libre] [PATCH] gnu: Add ungoogled-chromium.

[Alexandre Oliva]

On Feb 16, 2019, Marius Bakke  wrote:

> Despite years of searching, I have not found any proprietary parts in
> first party code!

Could you please summarize what you did in your searching?

Maybe you have actually completed the steps that were missing in the
auditing or Chromium to conclude it's Free, or at least some of the
remaining tasks can be checked off.

-- 
Alexandre Oliva, freedom fighter   https://FSFLA.org/blogs/lxo
Be the change, be Free! FSF Latin America board member
GNU Toolchain EngineerFree Software Evangelist
Hay que enGNUrecerse, pero sin perder la terGNUra jamás-GNUChe

Re: [GNU-linux-libre] [PATCH] gnu: Add ungoogled-chromium.

[Marius Bakke]

Amin,

Amin Bandali  writes:

> Marius, if I understand correctly, you have summarized your patch with
> respect to the following two issues:
>
> 1. Your patch strips out parts of Chromium that are /clearly/ nonfree
>and proprietary (e.g. unrar per your example), and
>
> 2. Your patch addresses (or tries to) privacy concerns.
>
> But as far as I can tell, you have not addressed the concerns shared by
> Bill and others about the situation with files in the Chromium codebase
> that don’t have a clear license.  So I’ll try to repeat/rephrase their
> question(s): does your patch address the files with unclear license?
> Does it strip out those files that don’t have a clear license?  Can we
> be certain that the Chromium built from your patch explicitly *only*
> contained free software?

Can you point out one or more files with an unclear license?  Do we have
any reason to distrust what's written in the LICENSE file?


signature.asc
Description: PGP signature

Re: [GNU-linux-libre] [PATCH] gnu: Add ungoogled-chromium.

[Adam Van Ymeren]

On February 16, 2019 9:18:58 AM EST, Julie Marchant  wrote:
>On 02/16/2019 05:25 AM, Brett Gilio wrote:
>> I agree with everything Bill said in his message, and I heavily
>> encourage all of us lurking in this mailing list with an opinion on
>the
>> matter to please state your opinion on this controversy and the Guix
>> relationship to the FSDG.
>> 
>> The free software guidelines are first and foremost put up by the
>free
>> software community by what is specified to be important to the values
>of
>> free software. This needs to be addressed sooner than later, because
>the
>> act of solidarity on the part of the community here is a tremendously
>> crucial and singular event.
>> 
>> I'd like to see the offerings of free software to grow, and include
>> chromium if chromium has a reasonable method of liberation. But there
>is
>> yet to be a complete audit to identify the problems. We can not rely
>> solely on speculation, so lets get to the bottom of this once and for
>> all.
>
>I think that assuming Chromium is no good until something no good is
>found in it is a wrong approach.
>
>I don't understand what's so complicated about this issue. In justice
>systems, we adopt an "innocent until proven guilty" system because you
>can't really prove innocence, only guilt. Would it not make sense to
>use
>this tried and tested system when evaluating whether or not a program
>is
>libre? The only argument I've seen on the matter is the way copyright
>works, but Chromium is under the Modified BSD License according to
>documentation I was able to find. If some files are not actually
>covered
>by this license, or some other license, it would be very easy to simply
>point to the file. As far as I know, and correct me if I'm wrong here,
>no one in the entire history of this claim about Chromium being
>proprietary has ever done so. If I'm wrong about this, though, then it
>seems to me that the correct action to take would be to address that
>issue, if not upstream, then in a fork.

This issue documents some chromium efforts to update to copyright on all files. 
 I haven't looked at the source myself yet but this bug suggests that there are 
still hundreds to thousand's of files with no clear license.

https://bugs.chromium.org/p/chromium/issues/detail?id=28291

Someone should run their check licenses script again on the latest codebase and 
see what it reports.

Re: [GNU-linux-libre] [PATCH] gnu: Add ungoogled-chromium.

[Amin Bandali]

Marius, if I understand correctly, you have summarized your patch with
respect to the following two issues:

1. Your patch strips out parts of Chromium that are /clearly/ nonfree
   and proprietary (e.g. unrar per your example), and

2. Your patch addresses (or tries to) privacy concerns.

But as far as I can tell, you have not addressed the concerns shared by
Bill and others about the situation with files in the Chromium codebase
that don’t have a clear license.  So I’ll try to repeat/rephrase their
question(s): does your patch address the files with unclear license?
Does it strip out those files that don’t have a clear license?  Can we
be certain that the Chromium built from your patch explicitly *only*
contained free software?

Best,
amin

Re: [GNU-linux-libre] [PATCH] gnu: Add ungoogled-chromium.

[znavko]

Hello, bill! Thanks for your clarifications!
Really, is it possible to make chromium free software?
Also, FSF free software directory can divide packages by criteria like
1) Totally free GNU - open-source and free license GPL
2) Totally free nonGNU - - open-source and free license non-GPL
3) Totally open-source (with non-free license)
4) Non-free

This may help people to solve such issues more conveniently, having this 
knowledge base.
It also will help developers to adopt FSDG.

Re: [GNU-linux-libre] [PATCH] gnu: Add ungoogled-chromium.

[Marius Bakke]

bill-auger  writes:

> On Mon, 04 Feb 2019 23:34:45 +0100 Ludovic wrote:
>> It’s not entirely clear to me what the problems are, to be honest.  
>
> On Wed, 06 Feb 2019 22:04:59 +0100 Marius wrote:
>> Indeed, the only real breakthrough is that we now have a script to
>> create an Ungooglified source tarball with all unnecessary third_party
>> components removed.
>> I am of course happy to help other FSDG distributions liberate their
>> Chromium too.  
>
> it is not clear to *anyone* precisely what the licensing problems are -
> not even the upstream developers have been able to confirm or deny them
> with any certainty - that is the very reason why this ugly situation has
> been standing all these years, as yet unresolved
>
> by your own admittance there, you have not "liberated" chromium - you
> have "ungooglified" it, and discarded some non-essential third-party
> code - the work of the "ungoogled" and "iridium" teams has been
> discussed at length and was concluded to be insufficient as a liberation
> procedure, because their work only addresses proivacy issues, but not
> licensing - "liberation" would first require *something* that is not
> FSDG compliant to be identified as such, and *then* for that something
> to be removed or patched in order to be compliant - neither of those
> events has occurred, and we all know it - that is the very reason this
> situation has stood unresolved for so long
>
> so, this recent work done by guix is not a resolution to the problem -
> it is merely sweeping the problem under the rug, rather than confronting
> it at face value, as Adfeno has been suggesting

For the benefit of everyone following this discussion, I'll summarize
the problems with Chromium and how they are addressed by my patch.

1) Chromium is non-free.

The raw Chromium tarball contains a lot of software that is non-free.
Heck, it's not even possible to build it without the proprietary Unrar
program unless you patch it!

Luckily, these non-free components are in various "third_party"
directories.  Thus, it is possible to traverse the tarball and remove
all such parts that are not already audited and whitelisted.  Which is
exactly what my patch does.

Despite years of searching, I have not found any proprietary parts in
first party code!  I cannot prove this obviously; but proving the
contrary should be trivial.

Thus, I surmise that the code is indeed free --- I would not have
submitted it for Guix if I had the slightest doubt to the contrary.

2) Chromium spies on the user.

Just starting the browser in the default configuration will cause it to
submit traffic to Google.  The exact nature of this data is unclear, but
such behaviour is clearly not something fit for a GNU distribution.

Ungoogled-Chromium solves this by 1) patching out all non-essential
functionality (such as "safe browsing" and web store integration); and
2) performing a tree-wide "domain substitution" such that all Google
(and some more) domains are replaced with a bogus "9oo91e.qjz9zk" domain.

I have verified that the browser sends no unsolicited network requests
when launching or during usage after applying the Ungoogled patches,
something I never managed with the "normal" free Chromium no matter how
many flags or patches I tried.

Thus, I surmise that this browser does indeed protect the users privacy.



Since there have been no coherent arguments against this browser in the
two weeks since it was submitted, I plan to push this patch *tomorrow*.

Thanks for the feedback,
Marius


signature.asc
Description: PGP signature

Re: [GNU-linux-libre] [PATCH] gnu: Add ungoogled-chromium.

[Gábor Boskovits]

Hello,

bill-auger  ezt írta (időpont: 2019. febr.
16., Szo, 9:01):

> it is not clear to *anyone* precisely what the licensing problems are -
> not even the upstream developers have been able to confirm or deny them
> with any certainty - that is the very reason why this ugly situation has
> been standing all these years, as yet unresolved
>

It seems to me, that there is a whole bunch of people interested in this,
but due to lack of resources or for some other reasons nothing is really
happening. Do you know any we we could help getting this resolved?

> by your own admittance there, you have not "liberated" chromium - you
> have "ungooglified" it, and discarded some non-essential third-party
> code - the work of the "ungoogled" and "iridium" teams has been
> discussed at length and was concluded to be insufficient as a liberation
> procedure, because their work only addresses proivacy issues, but not
> licensing - "liberation" would first require *something* that is not
> FSDG compliant to be identified as such, and *then* for that something
> to be removed or patched in order to be compliant - neither of those
> events has occurred, and we all know it - that is the very reason this
> situation has stood unresolved for so long

I also suspect, that the possible licensing problems are not resolved by this,
if they even exists, what seemingly noone has checked yet.

Also, what ensures you that on the very next commit no non-free software gets
included?

> about a year ago, the FSDG review process and criteria for endorsement
> of new distros was updated - the new FSDG criteria checklist for
> community review that was adopted includes the following essential
> criteria:
>
>   "Programs commonly known to have freedom issues are liberated or
>   excluded"
>
> that criteria is a link to the "software that does not respect the
> FSDG" wiki page, which includes an entry for 'chromium-browser' (the
> debian package name) with the liberation procedure being specified as:
>
>   "Remove program/package Use GNU IceCat, or equivalent"
>
> that created an uncomfortable pressure point for any distro that wants
> to distribute this browser - according to the literal reading of that
> criteria, no new distro could be endorsed by the FSF today if it
> distributes chromium; because it would never make it past the community
> review stage - this was not a concern for the last new distro because
> it did not include chromium; so that ugly wart is still sitting there
> today

The main question is what needs to be done, in order to get chromium off
that list. Whatever it takes however, it is very clear that upstream won't do
that, so it is not an option to rely on them any more. What's the way forward?

> if chromium enters the guix repo it will almost surely be followed by a
> freedom bug report (which per the current FSDG criteria, would be fully
> justifiable), just as what happened with pureos; which they reluctantly,
> but eventually acted upon by removing chromium from their free repos -
> so, why would guix want to invite controversy, by knowingly repeating
> this historical mistake?

Most probably you are right on this point.

>
> this is not a comfortable situation for anyone - a number of people
> on this list have openly expressed a strong dislike for that current
> situation - it is a really ugly point of contention at the moment; but
> nothing has been done about it yet - i think the reason for that, is
> mainly because there has been too few interested in defending or
> liberating that program until now - even the pureos devs, who were the
> last to remove it, were not particularly fond of it, but were slow to
> remove it, only to appease users - this would be a great entry point for
> guix to join the discussions on the FSDG mailing list, and perhaps
> resolve this issue for everyone, including distros yet to come
>
> it was, of course, nice of Marius to offer to assist other distros; but
> individual assistance is not what is needed - what is needed is a
> generally agreed upon, documented, liberation procedure that can
> replace: "Use GNU IceCat instead" as the new FSDG recommendation - i
> think we would all like to see that happen; but i dont think anything
> convincing has yet been presented, much less been discussed openly or
> agreed upon
>

Yes I think it would be really important to decide what liberation procedure
would be applicable.

>
> [1]: https://debbugs.gnu.org/cgi/bugreport.cgi?msg=305;bug=28004;att=0
>

Best regards,
g_bor

Re: [GNU-linux-libre] [PATCH] gnu: Add ungoogled-chromium.

[Julie Marchant]

On 02/16/2019 05:25 AM, Brett Gilio wrote:
> I agree with everything Bill said in his message, and I heavily
> encourage all of us lurking in this mailing list with an opinion on the
> matter to please state your opinion on this controversy and the Guix
> relationship to the FSDG.
> 
> The free software guidelines are first and foremost put up by the free
> software community by what is specified to be important to the values of
> free software. This needs to be addressed sooner than later, because the
> act of solidarity on the part of the community here is a tremendously
> crucial and singular event.
> 
> I'd like to see the offerings of free software to grow, and include
> chromium if chromium has a reasonable method of liberation. But there is
> yet to be a complete audit to identify the problems. We can not rely
> solely on speculation, so lets get to the bottom of this once and for
> all.

I think that assuming Chromium is no good until something no good is
found in it is a wrong approach.

I don't understand what's so complicated about this issue. In justice
systems, we adopt an "innocent until proven guilty" system because you
can't really prove innocence, only guilt. Would it not make sense to use
this tried and tested system when evaluating whether or not a program is
libre? The only argument I've seen on the matter is the way copyright
works, but Chromium is under the Modified BSD License according to
documentation I was able to find. If some files are not actually covered
by this license, or some other license, it would be very easy to simply
point to the file. As far as I know, and correct me if I'm wrong here,
no one in the entire history of this claim about Chromium being
proprietary has ever done so. If I'm wrong about this, though, then it
seems to me that the correct action to take would be to address that
issue, if not upstream, then in a fork.

-- 
Julie Marchant
http://onpon4.github.io

Encrypt your emails with GnuPG:
https://emailselfdefense.fsf.org

Re: [GNU-linux-libre] [PATCH] gnu: Add ungoogled-chromium.

[Brett Gilio]

bill-auger writes:

> On Mon, 04 Feb 2019 23:34:45 +0100 Ludovic wrote:
>> It’s not entirely clear to me what the problems are, to be honest.  
>
> On Wed, 06 Feb 2019 22:04:59 +0100 Marius wrote:
>> Indeed, the only real breakthrough is that we now have a script to
>> create an Ungooglified source tarball with all unnecessary third_party
>> components removed.
>> I am of course happy to help other FSDG distributions liberate their
>> Chromium too.  
>

I agree with everything Bill said in his message, and I heavily
encourage all of us lurking in this mailing list with an opinion on the
matter to please state your opinion on this controversy and the Guix
relationship to the FSDG.

The free software guidelines are first and foremost put up by the free
software community by what is specified to be important to the values of
free software. This needs to be addressed sooner than later, because the
act of solidarity on the part of the community here is a tremendously
crucial and singular event.

I'd like to see the offerings of free software to grow, and include
chromium if chromium has a reasonable method of liberation. But there is
yet to be a complete audit to identify the problems. We can not rely
solely on speculation, so lets get to the bottom of this once and for
all.

Brett Gilio

Re: [GNU-linux-libre] [PATCH] gnu: Add ungoogled-chromium.

[bill-auger]

On Mon, 04 Feb 2019 23:34:45 +0100 Ludovic wrote:
> It’s not entirely clear to me what the problems are, to be honest.  

On Wed, 06 Feb 2019 22:04:59 +0100 Marius wrote:
> Indeed, the only real breakthrough is that we now have a script to
> create an Ungooglified source tarball with all unnecessary third_party
> components removed.
> I am of course happy to help other FSDG distributions liberate their
> Chromium too.  

it is not clear to *anyone* precisely what the licensing problems are -
not even the upstream developers have been able to confirm or deny them
with any certainty - that is the very reason why this ugly situation has
been standing all these years, as yet unresolved

by your own admittance there, you have not "liberated" chromium - you
have "ungooglified" it, and discarded some non-essential third-party
code - the work of the "ungoogled" and "iridium" teams has been
discussed at length and was concluded to be insufficient as a liberation
procedure, because their work only addresses proivacy issues, but not
licensing - "liberation" would first require *something* that is not
FSDG compliant to be identified as such, and *then* for that something
to be removed or patched in order to be compliant - neither of those
events has occurred, and we all know it - that is the very reason this
situation has stood unresolved for so long

so, this recent work done by guix is not a resolution to the problem -
it is merely sweeping the problem under the rug, rather than confronting
it at face value, as Adfeno has been suggesting


On Thu, 07 Feb 2019 18:52:02 -0500 Christopher wrote:
> +1 ... If concrete problems are found, by all means those should be
> raised and addressed.  Otherwise I really think we ought to merge this
> work.  

this statement is indicative of the lack of concern for the wider FSDG
ecosystem which is implicit in most of the guix team's statements on
this issue - do correct me if im wrong, but i read that: "we" as:
"guix" - as in: guix should adopt this program - as in: regardless of
the long standing consensus among the other FSDG distros that it is not
yet fit for inclusion

this is puts the other FSDG distros in a very uncomfortable position;
and the chromium program specifically, is not really the crux of the
issue - i do hope that i have not lost anyone's attention yet; because
this is where i will try to explain, what is the critical point of
contention at this time

about a year ago, the FSDG review process and criteria for endorsement
of new distros was updated - the new FSDG criteria checklist for
community review that was adopted includes the following essential
criteria:

  "Programs commonly known to have freedom issues are liberated or
  excluded"

that criteria is a link to the "software that does not respect the
FSDG" wiki page, which includes an entry for 'chromium-browser' (the
debian package name) with the liberation procedure being specified as:

  "Remove program/package Use GNU IceCat, or equivalent"

that created an uncomfortable pressure point for any distro that wants
to distribute this browser - according to the literal reading of that
criteria, no new distro could be endorsed by the FSF today if it
distributes chromium; because it would never make it past the community
review stage - this was not a concern for the last new distro because
it did not include chromium; so that ugly wart is still sitting there
today

it was also agreed upon at that time, that the FSDG criteria should be
applicable to all currently endorsed distros in perpetuity, so ...


On Mon, 04 Feb 2019 23:34:45 +0100 Ludovic wrote:
> I’d also like to stress that, if Chromium is eventually included in
> Guix, we are committed to fixing it or removing it should someone
> later discover that it does not comply with the FSDG (that’s the
> “Commitment to Correct Mistakes” section of FSDG.)  

if chromium enters the guix repo it will almost surely be followed by a
freedom bug report (which per the current FSDG criteria, would be fully
justifiable), just as what happened with pureos; which they reluctantly,
but eventually acted upon by removing chromium from their free repos -
so, why would guix want to invite controversy, by knowingly repeating
this historical mistake?

and BTW, where was guix's voice on this matter last year when pureos was
trying to defend their very same position on this very same issue? - no
one came forward to back them up on that position then; and to their
credit, they decided to adopt the position of the group, for the sake of
presenting a coherent message to the free software community as a
unified group - that was an important gesture on their part, which
strengthened the credibility of the FSDG, by showing that its
guidelines are not subject to the interpretation of each distro
arbitrarily - perhaps that consensus could have gone the other way if
the argument: "we should always trust the upstream on their word"[1]
had gained favor, and guix's induction of a chromium 

Re: [GNU-linux-libre] [PATCH] gnu: Add ungoogled-chromium.

[Marius Bakke]

Denis 'GNUtoo' Carikli  writes:

> The 4-clause BSD license now seem gone[2], however there is still a
> combination of the Apache 2.0 license with one GPL-2.0 only license for
> jquery.hotkeys.js. Is the combination of the files covered by the
> GPLv2-only and the Apache2 not considered a combined work in that case?

jquery.hotkeys.js is not present in the tarball in question.

> Also some files/projects are under the LGPLv2.1 while some other are
> under the Apache2 license. Is that compatible?

All LGPL projects I've found have been "LGPL2.x or later", so IIUC they
can be upgraded to LGPL3 for Apache compatibility (if need be).


signature.asc
Description: PGP signature

Re: [GNU-linux-libre] [PATCH] gnu: Add ungoogled-chromium.

[Denis 'GNUtoo' Carikli]

On Sat, 9 Feb 2019 15:35:38 -0500
Luke  wrote:

> I would also like to see an updated audit of the code to ensure that
> the licensing issues mentioned previously have been fully resolved.
> There are still quite a number of open license bugs on their bug
> tracker:
> https://bugs.chromium.org/p/chromium/issues/list?can=2=licensecheck
As I understand this points out files that don't have copyright
headers.

In general I don't know if it makes sense to review each files for
copyright information or not. When adding new packages, I usually still
do some basic checks to understand what the precise license is, as a
GPLv2-only file will then make the combined work GPLv2-only. I'm also
assuming that files lacking a licenses statements defaults to the
project license. I also check for known potential issues like nonfree
firmwares and such when applicable. Is that enough or am I supposed to
do more checks?

However given the amount of projects that were combined into such
browsers it would at least make sense to make sure that the licenses
of each projects are compatible with each others.

In the past[2], there was even a combination of the 4-clause BSD
license with the LGPLv2. I'm not familiar enough with the LGPL licenses
family, was that compatible?

The 4-clause BSD license now seem gone[2], however there is still a
combination of the Apache 2.0 license with one GPL-2.0 only license for
jquery.hotkeys.js. Is the combination of the files covered by the
GPLv2-only and the Apache2 not considered a combined work in that case?

Also some files/projects are under the LGPLv2.1 while some other are
under the Apache2 license. Is that compatible?

What is the combined license of such browsers?

Note that I personally don't want to use the chromium browser to
browser the web, however as a lot of packages depend on qt5-webengine,
it would be nice to fix this issue in order not to stop being able to
use theses packages.

In some cases qt5-webengine may be used to access local resources like
documentation, so if some of the nasty features like DRM are removed,
and that it is not used to access resources over the Internet, as I
understand, there would not be any privacy harm.

References:
---
[1]https://bugs.chromium.org/p/chromium/issues/attachmentText?aid=95103
[2]https://metadata.ftp-master.debian.org/changelogs/main/c/chromium-browser/chromium-browser_70.0.3538.110-1_copyright

Denis.


pgp_7G6m22RlB.pgp
Description: OpenPGP digital signature

Re: [GNU-linux-libre] [PATCH] gnu: Add ungoogled-chromium.

[Luke]

On 02/09/2019 09:04 AM, Adonay Felipe Nogueira wrote:
> Another alternative is of course to ditch Chromium and
> Ungoogled-Chromium and focus on Iridium Browser[3].

Ungoogled-Chromium already contains the Iridium patchset in addition to
others.
https://github.com/Eloston/ungoogled-chromium#borrowed-features

What it is still lacking in this project is the removal of DRM such as
WideVine. Ultimately this should be patched out, or set as disabled
during compile.
I would also like to see an updated audit of the code to ensure that the
licensing issues mentioned previously have been fully resolved. There
are still quite a number of open license bugs on their bug tracker:
https://bugs.chromium.org/p/chromium/issues/list?can=2=licensecheck




signature.asc
Description: OpenPGP digital signature

Re: [GNU-linux-libre] [PATCH] gnu: Add ungoogled-chromium.

[Adonay Felipe Nogueira]

Em 04/02/2019 02:52, bill-auger escreveu:
> re: https://lists.gnu.org/archive/html/guix-devel/2019-02/msg9.html
> 
> i would like to remind readers of the guix-devel list that it was
> discussed some months ago, why no FSDG distros currently distribute
> chromium[1] - it appeared at that time, that most people in that
> discussion were in agreement that chromium should not be included in
> guix; and marius was instead hosting it in a private repo, as not to
> taint the main guix repos with dubious software - has there been a
> notable break-through since then?
> 
> what is the evidence for this claim that this guix package is "free
> software only"? - what does "Marks beautiful computed-origin-method" do
> toward that end? - if a procedure for liberating any chromium-derived
> software has been discovered, this would be a marvelous accomplishment
> and very good news indeed, of which people outside of the guix dev team
> would also be interested to learn

On this matter, I think this discussion and also the review should be
tracked either in a bug report or in the Free Software Directory wiki
talk page about Chromium package/entry[1], this one also has a partial
review still to be finished. Besides, the last time I read the FSD's
entry inclusion requirements (about June, 2018) I was informed also in
IRC that they have plans to make the FSD mimic the requirements of the
GNU FSDG so that free/libre system distributions would have an easier
time getting a list of reviewed packages for inclusion. That means that
the FSD would also have the requirements from the GNU FSDG regarding not
including malware and not steering towards non-free functional data.
There are optional things to consider, for which the Antifeature Project
Team is working on drafting[2], although these are not requirements for
inclusion in the FSD.

Regarding the review results in the page referenced by [1], please keep
in mind that the torrents have no trackers, so please share/seed with
DHT and PEX enabled so others can discover the shares too.

Another alternative is of course to ditch Chromium and
Ungoogled-Chromium and focus on Iridium Browser[3].

Anyways, if you do want to see progress in the Chromium review, please
contribute by downloading, seeding and also actually reviewing parts of
the reports generated. The last stop is marked with "Continue.". I did
start the review, but I'm not the most experienced person in regards to
all of legal, security and privacy matters. Just remember to remake a
torrent with the modified report and change the old hash in the page to
the new one you're seeding if you do make changes to the report, and
mark/save the change as major so that other people get notified.

Lastly, bill-auger's question of which should be the "assumed value" for
the GNU FSDG compliance status of a unreviewed package, based on various
proofs related to the dangers of non-free software (well, gnu.org has a
page with these reports/news[4]) and also on the reasoning given by
Richard Stallman in his talks[5], the unreviewed entries should be
considered non-free.

[1] https://directory.fsf.org/wiki/Talk:Chromium
[2] https://directory.fsf.org/wiki/Free_Software_Directory:Antifeatures
[3] https://directory.fsf.org/wiki/Iridium_Browser
[4] https://www.gnu.org/proprietary/proprietary.html
[5]
http://audio-video.gnu.org/video/2015-10-24--rms--free-software-and-your-freedom--seagl--speech.ogv



signature.asc
Description: OpenPGP digital signature

Re: [GNU-linux-libre] [PATCH] gnu: Add ungoogled-chromium.

[Christopher Lemmer Webber]

Ludovic Courtès writes:

> Hi bill-auger,
>
> bill-auger  skribis:
>
>> re: https://lists.gnu.org/archive/html/guix-devel/2019-02/msg9.html
>>
>> i would like to remind readers of the guix-devel list that it was
>> discussed some months ago, why no FSDG distros currently distribute
>> chromium[1] - it appeared at that time, that most people in that
>> discussion were in agreement that chromium should not be included in
>> guix; and marius was instead hosting it in a private repo, as not to
>> taint the main guix repos with dubious software - has there been a
>> notable break-through since then?
>
> It’s not entirely clear to me what the problems are, to be honest.
> Marius listed specific issues that were addressed by the patches; others
> then pointed out at additional issues that ungoogled-chromium fixes,
> which Marius took into account; what’s left now?
>
> I understand you’re skeptical about Chromium, but we cannot base
> decisions based on vague skepticism.  If you know of issues that are
> still unaddressed, please do list them.
>
> I’d also like to stress that, if Chromium is eventually included in
> Guix, we are committed to fixing it or removing it should someone later
> discover that it does not comply with the FSDG (that’s the “Commitment
> to Correct Mistakes” section of FSDG.)

+1 ... If concrete problems are found, by all means those should be
raised and addressed.  Otherwise I really think we ought to merge this
work.

Re: [GNU-linux-libre] [PATCH] gnu: Add ungoogled-chromium.

[Marius Bakke]

Ludovic Courtès  writes:

> Hi bill-auger,
>
> bill-auger  skribis:
>
>> re: https://lists.gnu.org/archive/html/guix-devel/2019-02/msg9.html
>>
>> i would like to remind readers of the guix-devel list that it was
>> discussed some months ago, why no FSDG distros currently distribute
>> chromium[1] - it appeared at that time, that most people in that
>> discussion were in agreement that chromium should not be included in
>> guix; and marius was instead hosting it in a private repo, as not to
>> taint the main guix repos with dubious software - has there been a
>> notable break-through since then?
>
> It’s not entirely clear to me what the problems are, to be honest.
> Marius listed specific issues that were addressed by the patches; others
> then pointed out at additional issues that ungoogled-chromium fixes,
> which Marius took into account; what’s left now?

Indeed, the only real breakthrough is that we now have a script to
create an Ungooglified source tarball with all unnecessary third_party
components removed.  The compressed tarball is smaller than that of
IceCat and takes up around 2.1 GiB uncompressed, roughly 1GiB of which
is third_party stuff.

That leaves "just" over 1GiB of source code to audit (assuming my
third_party audit is correct).  I haven't been able to find any
proprietary parts in first party code, and am convinced that the
remaining third_party components are free, hence this patch.

I am of course happy to help other FSDG distributions liberate their
Chromium too.


signature.asc
Description: PGP signature

Re: [GNU-linux-libre] [PATCH] gnu: Add ungoogled-chromium.

[Jean Louis]

On Mon, Feb 04, 2019 at 12:34:55PM -0500, bill-auger wrote:
> the single purpose of this thread was to invite
> the guix folks into this conversation - one of
> them appears to have made some significant
> progress toward liberating chromium (for
> whatever thats worth) - i would like to give
> them the opportunity to present the results with
> this list for discussion; but they have not done
> that yet

I am sure you would get attention, but file a bug:
https://www.gnu.org/software/guix/contribute/

make proposals at right place.

Jean

Re: [GNU-linux-libre] [PATCH] gnu: Add ungoogled-chromium.

[Jean Louis]

On Mon, Feb 04, 2019 at 12:28:18PM -0500, Julie Marchant wrote:
> On 02/04/2019 09:09 AM, bill-auger wrote:
> > On Mon, 4 Feb 2019 07:21:13 -0500 Julie wrote:
> > i really must disagree with that - the default copy permissions for
> > every copyrighted work is "none" - in order for that work be be set
> > free, the author must very explicitly label it as such, and try
> > their very best to ensure that their formal statement of permission
> > follows along with any copies of it - if that permission is missing, or
> > difficult to locate or comprehend, there is no reason to assume the work
> > is freely distributable - but dont take it from me - iam just a
> > musician - i am quite certain though, that if you asked a copyright
> > lawyer or judge, that would be their professional opinion
> 
> This is what the Chromium project has to say:
> 
> https://chromium.googlesource.com/chromium/src/+/master/LICENSE
> 
> So we're not working on a "no permission"
> default here. The Chromium developers say that's
> the license of Chromium. If they're lying, that
> can be proven. And if you do so, I will be the
> first to admit that I was wrong.
> 
> So, what part of Chromium is not actually
> covered by the Chromium license, and why?

Reference:
https://bugs.chromium.org/p/chromium/issues/detail?id=28291

I can just see in past that there were issues on
various files and licenses.

If those issues are clarified or finalized, I
don't know.

The other reference I know is that there are some
proprietary plugins which can be enabled in
Chromium. How is that distributed or provided, I
don't know.

Jean

Re: [GNU-linux-libre] [PATCH] gnu: Add ungoogled-chromium.

[Julie Marchant]

On 02/04/2019 09:09 AM, bill-auger wrote:
> On Mon, 4 Feb 2019 07:21:13 -0500 Julie wrote:
> i really must disagree with that - the default copy permissions for
> every copyrighted work is "none" - in order for that work be be set
> free, the author must very explicitly label it as such, and try
> their very best to ensure that their formal statement of permission
> follows along with any copies of it - if that permission is missing, or
> difficult to locate or comprehend, there is no reason to assume the work
> is freely distributable - but dont take it from me - iam just a
> musician - i am quite certain though, that if you asked a copyright
> lawyer or judge, that would be their professional opinion

This is what the Chromium project has to say:

https://chromium.googlesource.com/chromium/src/+/master/LICENSE

So we're not working on a "no permission" default here. The Chromium
developers say that's the license of Chromium. If they're lying, that
can be proven. And if you do so, I will be the first to admit that I was
wrong.

So, what part of Chromium is not actually covered by the Chromium
license, and why?

-- 
Julie Marchant
http://onpon4.github.io

Encrypt your emails with GnuPG:
https://emailselfdefense.fsf.org

Re: [GNU-linux-libre] [PATCH] gnu: Add ungoogled-chromium.

[Julie Marchant]

On 02/04/2019 09:46 AM, Jean Louis wrote:
> Here are few references from GNU.org:
> https://www.gnu.org/proprietary/malware-google.html
> 
> QUOTE:
> 
> "Chrome implements DRM. So does Chromium, through
> nonfree software that is effectively part of it."
> 
> Thus such software cannot be included in free
> software system distributions.
> 
> Read more on the same page.

The bug report linked to seems to suggest to me that they fixed the
issue. But that's not really what I was talking about. I was talking
about the widespread rumor that there's a problem with Chromium's
licensing, which I have never seen a single shred of evidence for.

If the DRM is the only problem, then the solution isn't to purge it from
all GNU FSDG distros, it's to remove the DRM. But the legend that
persists is that Chromium would be non-libre anyway because there's no
proof that it *doesn't* have proprietary components. That is an
impossible standard. I'm sorry, but there's no proof that Firefox,
Linux, GNU Chess, GNOME, or any other piece of software has no
proprietary components. There is no way to prove it. If I claim that GNU
Chess has proprietary components, that burden of proof is on me, not
you. The same should apply to Chromium.

So just to recap, we have evidence that Chromium needs to be modified to
be libre, just like Firefox does. I accept that.

But if there are other problems in Chromium or the Blink engine, that
needs to be proven. We can't go just assuming a program is proprietary
because someone said it is a decade ago and we can't prove 100% that it
isn't.

-- 
Julie Marchant
http://onpon4.github.io

Encrypt your emails with GnuPG:
https://emailselfdefense.fsf.org

Re: [GNU-linux-libre] [PATCH] gnu: Add ungoogled-chromium.

[bill-auger]

wow you guy are nit-picking me to the core today

i actually re-worded that already - it originally read "freely
distributable" - by which, in the context of the FSDG mailing list, i
totally meant as a short-hand for: all four freedoms and
everything else that the FSDG requires to make some software "freely
distributable" by a FSDG distro

for absolute clarity - i will restate again

one (and only one) of the following statements must be true:

* the chromium software provides all of the four freedoms and
  everything else that the FSDG requires to make some software "freely
  distributable" by a FSDG distro
* the chromium software does not provide all of the four freedoms and
  everything else that the FSDG requires to make some software "freely
  distributable" by a FSDG distro

thats totally what i meant and i assumed that everyone on this list
would take it as such - my bad

Re: [GNU-linux-libre] [PATCH] gnu: Add ungoogled-chromium.

[Jean Louis]

On Mon, Feb 04, 2019 at 05:56:56AM -0500, bill-auger wrote:
> On Mon, 4 Feb 2019 02:46:30 -0500 Ineiev wrote:
> > On Sun, Feb 03, 2019 at 11:52:04PM -0500, bill-auger wrote:
> > > the main, central FSDG concern: which programs are
> > > freely distributable and which are not  
> > 
> > I don't think the main FSDG concern is which programs are freely
> > distributable, and even which programs are free
> 
> geez, i almost erased that bit before sending it too :( - to be clear:
> by "freely distributable" i totally meant "provides all five of the
> four freedoms"
> 
> i will append just this - the issue here is really quite simple to
> express - one (and only one) of the following statements must be true:
> 
> * the chromium software provides all of the four freedoms
> * the chromium software does not provide all of the four freedoms
> 
> there is no third option

I am not sure that issue is just that simple.

Software may have free license, but it may be made
to control users, or steer to non-free software.

I cannot know if Chromium is now full free, but I
do know, and there are references on issues, here
is one example I found:
https://tracker.pureos.net/T57

There are various issues here referenced:
https://en.wikipedia.org/wiki/Talk:Chromium_(web_browser)

In general, one can make also the free software
that is controlling user or abusing users'
privacy, or sending information to companies
worldwide.

Should such software be included in free software
distributions? I don't think so.

None of 4 freedoms is referencing "no spyware",
but the guidelines do:
https://www.gnu.org/distros/free-system-distribution-guidelines.html

"The distro must contain no DRM, no back doors,
and no spyware."

That is just example, as so far I know, Chromium
was so much connected to Google and was sending
data there.

Jean

Re: [GNU-linux-libre] [PATCH] gnu: Add ungoogled-chromium.

[Jean Louis]

On Mon, Feb 04, 2019 at 07:21:13AM -0500, Julie Marchant wrote:
> I'm not sure if I've mentioned it on this list before, but I have never
> seen any actual evidence of the current version of Chromium containing
> proprietary components.

Here are few references from GNU.org:
https://www.gnu.org/proprietary/malware-google.html

QUOTE:

"Chrome implements DRM. So does Chromium, through
nonfree software that is effectively part of it."

Thus such software cannot be included in free
software system distributions.

Read more on the same page.

Jean

Re: [GNU-linux-libre] [PATCH] gnu: Add ungoogled-chromium.

[brettg]

As always, I second Bill here. There is a lot of history behind the 
Chromium project that I think many of us are aware of. There, to my 
knowledge, remains to be a complete audit of the Chromium source. Such 
an audit is crucial for us to even know what is problematic and what is 
not when it comes to FSDG compliance. So, unless the ungoogled chromium 
project has done this audit successfully I remain a kind skeptic.


On 04.02.2019 05:52, bill-auger wrote:

re: https://lists.gnu.org/archive/html/guix-devel/2019-02/msg9.html

i would like to remind readers of the guix-devel list that it was
discussed some months ago, why no FSDG distros currently distribute
chromium[1] - it appeared at that time, that most people in that
discussion were in agreement that chromium should not be included in
guix; and marius was instead hosting it in a private repo, as not to
taint the main guix repos with dubious software - has there been a
notable break-through since then?

what is the evidence for this claim that this guix package is "free
software only"? - what does "Marks beautiful computed-origin-method" do
toward that end? - if a procedure for liberating any chromium-derived
software has been discovered, this would be a marvelous accomplishment
and very good news indeed, of which people outside of the guix dev team
would also be interested to learn

if the guix team has discovered some new information or has concocted a
viable liberation recipe for chromium or any of it's offspring, then i
hope that, for the benefit of all fellow Fosstopians, someone would
present that information to the FSDG mailing list for review and
discussion - it would be extra neighborly if that happened *before*
offering this program to guix users, while fully knowing that the other
FSDG distros are still intentionally suppressing it in solidarity

again, i am totally indifferent as to whether anyone uses chromium or
not - my only interest in this is that i would like to strengthen the
FSDG by convincing FSDG distros to communicate and collaborate with 
each

other, and to achieve consensus about common issues such as this, that
clearly affect all distros equally; so that no one is compelled to ask
"why does guixsd endorse that popular program if other FSDG distros
reject it on principal?" - it is difficult enough to explain to users
why these programs are rejected in the first place; but at least the
way things are now, we can say that all FSDG distros are in agreement 
to

err on the conservative side until a satisfactory liberation procedure
is found and documented - currently, the documented liberation
procedure is: "Remove program/package. Use GNU IceCat, or
equivalent"[2] - if there is a better candidate procedure now, let us
get it onto the table for discussion

i would like to consider all FSDG distros as being part of a larger
federation, sharing the same primary goals; but we cant all be reading
all of the dev lists - let us communicate whenever applicable, in the
common venue that exists for that purpose[3] - i tried enticing the
folks on the guix team to do that previously - if there is indeed
something new to announce regarding chromium's dubious FSDG status,
please elect someone from guix to do so now - this would be very
interesting news to the readers of that list, and your effort and/or
accomplishment would be sincerely applauded - other FSDG distros would
be happy (and some quite eager) to re-instate any of these
chromium-derived packages if a consensus could be reached that any of
them could be distributed 100% freely; but if all distros are to decide
for themselves what is freely distributable and what is not, without
evidence and without discussing it with the other FSDG distros nor the
FSF, then the FSDG loses its teeth, and we all look wishy-washy and
flakey on that, the main, central FSDG concern: which programs are
freely distributable and which are not


[1]: 
https://lists.gnu.org/archive/html/guix-devel/2018-09/msg00264.html

[2]:
https://libreplanet.org/wiki/List_of_software_that_does_not_respect_the_Free_System_Distribution_Guidelines#chromium-browser
[3]: https://lists.nongnu.org/mailman/listinfo/gnu-linux-libre

Re: [GNU-linux-libre] [PATCH] gnu: Add ungoogled-chromium.

[andrew]

> On 04 February 2019 at 07:46 Ineiev mailto:ine...@gnu.org > 
> wrote:
> 
> 
> On Sun, Feb 03, 2019 at 11:52:04PM -0500, bill-auger wrote:
> 
> > > FSF, then the FSDG loses its teeth, and we all look wishy-washy 
> and
> > flakey on that, the main, central FSDG concern: which programs are
> > freely distributable and which are not
> > 
> > > I don't think the main FSDG concern is which programs are freely
> distributable, and even which programs are free; IMHO it is,
> "a free system distribution must not steer users towards obtaining
> any nonfree information for practical use."
> 

And 'information for practical use' is defined to include free software and 
it's ancillaries.  See the first paragraph following the FSDG 'License Rules' 
heading[1].


Leny


[1] http://www.gnu.org/distros/free-system-distribution-guidelines.html

Re: [GNU-linux-libre] [PATCH] gnu: Add ungoogled-chromium?

[zap]

On 02/03/2019 11:52 PM, bill-auger wrote:
> re: https://lists.gnu.org/archive/html/guix-devel/2019-02/msg9.html
>
> i would like to remind readers of the guix-devel list that it was
> discussed some months ago, why no FSDG distros currently distribute
> chromium[1] - it appeared at that time, that most people in that
> discussion were in agreement that chromium should not be included in
> guix; and marius was instead hosting it in a private repo, as not to
> taint the main guix repos with dubious software - has there been a
> notable break-through since then?
>
> what is the evidence for this claim that this guix package is "free
> software only"? - what does "Marks beautiful computed-origin-method" do
> toward that end? - if a procedure for liberating any chromium-derived
> software has been discovered, this would be a marvelous accomplishment
> and very good news indeed, of which people outside of the guix dev team
> would also be interested to learn
>
> if the guix team has discovered some new information or has concocted a
> viable liberation recipe for chromium or any of it's offspring, then i
> hope that, for the benefit of all fellow Fosstopians, someone would
> present that information to the FSDG mailing list for review and
> discussion - it would be extra neighborly if that happened *before*
> offering this program to guix users, while fully knowing that the other
> FSDG distros are still intentionally suppressing it in solidarity
>
> again, i am totally indifferent as to whether anyone uses chromium or
> not - my only interest in this is that i would like to strengthen the
> FSDG by convincing FSDG distros to communicate and collaborate with each
> other, and to achieve consensus about common issues such as this, that
> clearly affect all distros equally; so that no one is compelled to ask
> "why does guixsd endorse that popular program if other FSDG distros
> reject it on principal?" - it is difficult enough to explain to users
> why these programs are rejected in the first place; but at least the
> way things are now, we can say that all FSDG distros are in agreement to
> err on the conservative side until a satisfactory liberation procedure
> is found and documented - currently, the documented liberation
> procedure is: "Remove program/package. Use GNU IceCat, or
> equivalent"[2] - if there is a better candidate procedure now, let us
> get it onto the table for discussion
>
> i would like to consider all FSDG distros as being part of a larger
> federation, sharing the same primary goals; but we cant all be reading
> all of the dev lists - let us communicate whenever applicable, in the
> common venue that exists for that purpose[3] - i tried enticing the
> folks on the guix team to do that previously - if there is indeed
> something new to announce regarding chromium's dubious FSDG status,
> please elect someone from guix to do so now - this would be very
> interesting news to the readers of that list, and your effort and/or
> accomplishment would be sincerely applauded - other FSDG distros would
> be happy (and some quite eager) to re-instate any of these
> chromium-derived packages if a consensus could be reached that any of
> them could be distributed 100% freely; but if all distros are to decide
> for themselves what is freely distributable and what is not, without
> evidence and without discussing it with the other FSDG distros nor the
> FSF, then the FSDG loses its teeth, and we all look wishy-washy and
> flakey on that, the main, central FSDG concern: which programs are
> freely distributable and which are not
>
>
> [1]: https://lists.gnu.org/archive/html/guix-devel/2018-09/msg00264.html
> [2]:
> https://libreplanet.org/wiki/List_of_software_that_does_not_respect_the_Free_System_Distribution_Guidelines#chromium-browser
> [3]: https://lists.nongnu.org/mailman/listinfo/gnu-linux-libre

I agree, for a rather different reason, to be honest, its the same
reason I dislike firefox quantum and am wary of even Abrowser/Icecat,
webextensions is trash. And nothing is gained by using any web browser
with it. I mean how many web browsers that use it are free software?
Yeah...  Besides, there's also some bad news going forward with chromium:

https://tech.slashdot.org/story/19/01/23/0048202/google-proposes-changes-to-chromium-browser-that-will-break-content-blocking-extensions-including-various-ad-blockers

I rather think more distros should at least if not outright replacing
firefox forks/firefox, should instead adopt this web browser:
https://github.com/g4jc/iceweasel-uxp/releases

It may be somewhat slower than your used to, but some of the addons for
it are still supported such as noscript, or ublock origin. It is
completely XUL based unlike Basilisk which its forked from.

I think at least though have it be an option instead of the standby. 
The more I hear about firefox/webextensions, the more I think its time
to ditch the new firefox in favor of continuing legacy support via

Re: [GNU-linux-libre] [PATCH] gnu: Add ungoogled-chromium.

[bill-auger]

On Mon, 4 Feb 2019 07:21:13 -0500 Julie wrote:
> It's an unreasonable standard to demand proof that programs are libre.

i really must disagree with that - the default copy permissions for
every copyrighted work is "none" - in order for that work be be set
free, the author must very explicitly label it as such, and try
their very best to ensure that their formal statement of permission
follows along with any copies of it - if that permission is missing, or
difficult to locate or comprehend, there is no reason to assume the work
is freely distributable - but dont take it from me - iam just a
musician - i am quite certain though, that if you asked a copyright
lawyer or judge, that would be their professional opinion

Re: [GNU-linux-libre] [PATCH] gnu: Add ungoogled-chromium.

[Julie Marchant]

On 02/03/2019 11:52 PM, bill-auger wrote:
> re: https://lists.gnu.org/archive/html/guix-devel/2019-02/msg9.html
> 
> i would like to remind readers of the guix-devel list that it was
> discussed some months ago, why no FSDG distros currently distribute
> chromium[1] - it appeared at that time, that most people in that
> discussion were in agreement that chromium should not be included in
> guix; and marius was instead hosting it in a private repo, as not to
> taint the main guix repos with dubious software - has there been a
> notable break-through since then?
> 
> what is the evidence for this claim that this guix package is "free
> software only"? - what does "Marks beautiful computed-origin-method" do
> toward that end? - if a procedure for liberating any chromium-derived
> software has been discovered, this would be a marvelous accomplishment
> and very good news indeed, of which people outside of the guix dev team
> would also be interested to learn
> 
> if the guix team has discovered some new information or has concocted a
> viable liberation recipe for chromium or any of it's offspring, then i
> hope that, for the benefit of all fellow Fosstopians, someone would
> present that information to the FSDG mailing list for review and
> discussion - it would be extra neighborly if that happened *before*
> offering this program to guix users, while fully knowing that the other
> FSDG distros are still intentionally suppressing it in solidarity
> 
> again, i am totally indifferent as to whether anyone uses chromium or
> not - my only interest in this is that i would like to strengthen the
> FSDG by convincing FSDG distros to communicate and collaborate with each
> other, and to achieve consensus about common issues such as this, that
> clearly affect all distros equally; so that no one is compelled to ask
> "why does guixsd endorse that popular program if other FSDG distros
> reject it on principal?" - it is difficult enough to explain to users
> why these programs are rejected in the first place; but at least the
> way things are now, we can say that all FSDG distros are in agreement to
> err on the conservative side until a satisfactory liberation procedure
> is found and documented - currently, the documented liberation
> procedure is: "Remove program/package. Use GNU IceCat, or
> equivalent"[2] - if there is a better candidate procedure now, let us
> get it onto the table for discussion
> 
> i would like to consider all FSDG distros as being part of a larger
> federation, sharing the same primary goals; but we cant all be reading
> all of the dev lists - let us communicate whenever applicable, in the
> common venue that exists for that purpose[3] - i tried enticing the
> folks on the guix team to do that previously - if there is indeed
> something new to announce regarding chromium's dubious FSDG status,
> please elect someone from guix to do so now - this would be very
> interesting news to the readers of that list, and your effort and/or
> accomplishment would be sincerely applauded - other FSDG distros would
> be happy (and some quite eager) to re-instate any of these
> chromium-derived packages if a consensus could be reached that any of
> them could be distributed 100% freely; but if all distros are to decide
> for themselves what is freely distributable and what is not, without
> evidence and without discussing it with the other FSDG distros nor the
> FSF, then the FSDG loses its teeth, and we all look wishy-washy and
> flakey on that, the main, central FSDG concern: which programs are
> freely distributable and which are not
> 
> 
> [1]: https://lists.gnu.org/archive/html/guix-devel/2018-09/msg00264.html
> [2]:
> https://libreplanet.org/wiki/List_of_software_that_does_not_respect_the_Free_System_Distribution_Guidelines#chromium-browser
> [3]: https://lists.nongnu.org/mailman/listinfo/gnu-linux-libre

I'm not sure if I've mentioned it on this list before, but I have never
seen any actual evidence of the current version of Chromium containing
proprietary components.

It's an unreasonable standard to demand proof that programs are libre.
That's an impossible thing to prove. If someone points out, as I have
many times, "I have looked through Chromium's code and not found a
single proprietary program," someone can simply say that they didn't
look hard enough.

That LibrePlanet page, by the way, is not evidence of Chromium
containing proprietary components. It claims such, but the only evidence
provided is a copyright file that clearly indicates a libre license, and
a bug report about not passing a license checking script, which I might
add is also not proof of any program being proprietary. Not to mention,
this is from over eight years ago. Should distro maintainers also take
the outdated recommendation to remove Project: Starfighter from that
page at face value, despite the fact that I released a completely libre
version almost four years ago? The point is, that's a wiki page
sporadically 

Re: [GNU-linux-libre] [PATCH] gnu: Add ungoogled-chromium.

[bill-auger]

... and we often use "FSDG-free" as a short-hand to imply everything
that the FSDG requires in order to be considered as "freely
distributable" by FSDG distros - all well beyond just freedom #2

Re: [GNU-linux-libre] [PATCH] gnu: Add ungoogled-chromium.

[bill-auger]

On Mon, 4 Feb 2019 02:46:30 -0500 Ineiev wrote:
> On Sun, Feb 03, 2019 at 11:52:04PM -0500, bill-auger wrote:
> > the main, central FSDG concern: which programs are
> > freely distributable and which are not  
> 
> I don't think the main FSDG concern is which programs are freely
> distributable, and even which programs are free

geez, i almost erased that bit before sending it too :( - to be clear:
by "freely distributable" i totally meant "provides all five of the
four freedoms"

i will append just this - the issue here is really quite simple to
express - one (and only one) of the following statements must be true:

* the chromium software provides all of the four freedoms
* the chromium software does not provide all of the four freedoms

there is no third option

according to the FSDG, qualifying distros are free to distribute any
software that is known to provide all of the four freedoms; and must
not distribute any software that does not meet that standard - we can
all agree on this so far - yes?

therefore, both of the following statements must be true:

* IF chromium provides all of the four freedoms, then any FSDG distro
  is free to distribute it, if they so choose

* IF chromium is not known to provide all of the four freedoms, or is
  known to not provide all of the four freedoms, then none of the
  FSDG distros should choose to distribute it; and any that does,
  should have a freedom bug posted against it immediately, just as
  happened with pureos

does anyone disagree with either of those two statements?

the FSDG itself is not really the issue here - it is quite clear on
most matters - the problem is that no one knows for certain which one
of those two statements is the actual case in reality - so the key
concerns are: "who shall make that determination?", and "by which
standards?"

should software be considered to be provide all of the four freedoms
until proven otherwise? (e.g. because someone slapped an MIT on top of
it) - or should software be considered to not necessarily provide all
of the four freedoms until proven to do so?

should each distro decide for itself what qualifies as FSDG-free
software and what does not? - or would such decisions be better made by
consensus with the guidance of the FSF?

Re: [GNU-linux-libre] [PATCH] gnu: Add ungoogled-chromium.

[bill-auger]

On Mon, 4 Feb 2019 04:39:06 -0500 Ineiev wrote:
> No, what qualifies as freely distributable is definitely not
> the primary concern. when only freedom 2 is respected, software
> is still nonfree.

ok i understand your objection now - when i write "freely
distributable" in the context of the FSDG, please take that to fully
imply all five of the four freedoms - that is exactly as i intended it
would be received to this audience - i will try not to be that
presumtuous again

Re: [GNU-linux-libre] [PATCH] gnu: Add ungoogled-chromium.

[Ineiev]

On Mon, Feb 04, 2019 at 04:04:41AM -0500, bill-auger wrote:
> 
> maybe its a bit of both; but it is necessarily the primary concern to
> define what qualifies as freely distributable and what does not;

No, what qualifies as freely distributable is definitely not
the primary concern. when only freedom 2 is respected, software
is still nonfree.


signature.asc
Description: Digital signature

Re: [GNU-linux-libre] [PATCH] gnu: Add ungoogled-chromium.

[bill-auger]

On Mon, 4 Feb 2019 02:46:30 -0500 Ineiev wrote:
> I don't think the main FSDG concern is which programs are freely
> distributable, and even which programs are free; IMHO it is,
> "a free system distribution must not steer users towards obtaining
> any nonfree information for practical use."

i think that difference of opinion hinges on the interpretation of
such "guidelines" as either a "behavioral code of ethics for distro
maintainers" or more plainly "recommended standards for product quality
assurance"

maybe its a bit of both; but it is necessarily the primary concern to
define what qualifies as freely distributable and what does not;
because that underpins any suggestions (whether ethical or merely
practical) for the handling of what is deemed to be not freely
distributable 

Re: [GNU-linux-libre] [PATCH] gnu: Add ungoogled-chromium.

[Ineiev]

On Sun, Feb 03, 2019 at 11:52:04PM -0500, bill-auger wrote:
> FSF, then the FSDG loses its teeth, and we all look wishy-washy and
> flakey on that, the main, central FSDG concern: which programs are
> freely distributable and which are not

I don't think the main FSDG concern is which programs are freely
distributable, and even which programs are free; IMHO it is,
"a free system distribution must not steer users towards obtaining
any nonfree information for practical use."


signature.asc
Description: Digital signature

Re: [GNU-linux-libre] [PATCH] gnu: Add ungoogled-chromium.

[bill-auger]

re: https://lists.gnu.org/archive/html/guix-devel/2019-02/msg9.html

i would like to remind readers of the guix-devel list that it was
discussed some months ago, why no FSDG distros currently distribute
chromium[1] - it appeared at that time, that most people in that
discussion were in agreement that chromium should not be included in
guix; and marius was instead hosting it in a private repo, as not to
taint the main guix repos with dubious software - has there been a
notable break-through since then?

what is the evidence for this claim that this guix package is "free
software only"? - what does "Marks beautiful computed-origin-method" do
toward that end? - if a procedure for liberating any chromium-derived
software has been discovered, this would be a marvelous accomplishment
and very good news indeed, of which people outside of the guix dev team
would also be interested to learn

if the guix team has discovered some new information or has concocted a
viable liberation recipe for chromium or any of it's offspring, then i
hope that, for the benefit of all fellow Fosstopians, someone would
present that information to the FSDG mailing list for review and
discussion - it would be extra neighborly if that happened *before*
offering this program to guix users, while fully knowing that the other
FSDG distros are still intentionally suppressing it in solidarity

again, i am totally indifferent as to whether anyone uses chromium or
not - my only interest in this is that i would like to strengthen the
FSDG by convincing FSDG distros to communicate and collaborate with each
other, and to achieve consensus about common issues such as this, that
clearly affect all distros equally; so that no one is compelled to ask
"why does guixsd endorse that popular program if other FSDG distros
reject it on principal?" - it is difficult enough to explain to users
why these programs are rejected in the first place; but at least the
way things are now, we can say that all FSDG distros are in agreement to
err on the conservative side until a satisfactory liberation procedure
is found and documented - currently, the documented liberation
procedure is: "Remove program/package. Use GNU IceCat, or
equivalent"[2] - if there is a better candidate procedure now, let us
get it onto the table for discussion

i would like to consider all FSDG distros as being part of a larger
federation, sharing the same primary goals; but we cant all be reading
all of the dev lists - let us communicate whenever applicable, in the
common venue that exists for that purpose[3] - i tried enticing the
folks on the guix team to do that previously - if there is indeed
something new to announce regarding chromium's dubious FSDG status,
please elect someone from guix to do so now - this would be very
interesting news to the readers of that list, and your effort and/or
accomplishment would be sincerely applauded - other FSDG distros would
be happy (and some quite eager) to re-instate any of these
chromium-derived packages if a consensus could be reached that any of
them could be distributed 100% freely; but if all distros are to decide
for themselves what is freely distributable and what is not, without
evidence and without discussing it with the other FSDG distros nor the
FSF, then the FSDG loses its teeth, and we all look wishy-washy and
flakey on that, the main, central FSDG concern: which programs are
freely distributable and which are not


[1]: https://lists.gnu.org/archive/html/guix-devel/2018-09/msg00264.html
[2]:
https://libreplanet.org/wiki/List_of_software_that_does_not_respect_the_Free_System_Distribution_Guidelines#chromium-browser
[3]: https://lists.nongnu.org/mailman/listinfo/gnu-linux-libre