Discussion June 2016

discussion@lists.fsfe.org

18 participants
16 discussions

Please help us spread the word on Roundcube Next
by Georg C. F. Greve 29 May '17

29 May '17

Dear all, In the spirit of full disclosure, let me start by pointing out that I am CEO and - along with other employees, some of whom you will also know - shareholder of Kolab Systems AG (https://kolabsystems.com) and that Kolab Systems has been the driving force behind Roundcube for the past years. Kolab Systems has also agreed to help the Roundcube Next team in its aim to refactor and build the next technology generation. So I am not neutral. That said, I genuinely believe it is extremely important for the Free Software community to get behind Roundcube Next and help us push it forward, as well as bring others on board with it. The longer story is here: http://blogs.fsfe.org/greve/?p=676 TL;DR, Part I: As a community we *require* technologies that compete with Google Apps, Office 365 and the likes in features, convenience, UI/UX, yet provide full control and freedom to users. TL;DR, Part II: Application Service Providers should get on board with that push *right now* because otherwise they will find themselves forced into becoming re-sellers for Office 365 and Google Apps -- and increasingly unable to compete with their features & networking effects. Some already understood this, and have joined the Roundcube Next community, such as cPanel (http://blog.cpanel.com/on-to-the-next/), Tucows, and now also Fastmail (http://blog.fastmail.com/2015/06/05/fastmail-supports-roundcube-next-develo…). But there are many more providers using Roundcube today who have not joined, nor have they contributed in the past. For them it should be obvious to join. And then there are those that have their own home-brew interfaces (such as Fastmail) who get the unique opportunity to become part of a new, growing community that will create a technology that will make them fully competitive against the "big clouds" in 18 months from now. Unfortunately, most of them have not realized this yet. So unless your provider is cPanel, Tucows, Fastmail or Kolab Now, all of who are part of this already, please encourage them to step up and join the community to push for Roundcube Next. Direct link for your convenience: https://www.indiegogo.com/projects/roundcube-next--2/x/4658765#/story Best regards, Georg -- Georg C. F. Greve <greve(a)fsfeurope.org> Member of the General Assembly http://fsfe.org/about/greve/ http://blogs.fsfe.org/greve/ http://identi.ca/greve

8 17

Uncorrectable freedom and security issues on x86 platforms
by Timothy Pearson 25 Oct '16

25 Oct '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 All, It has recently come to my attention that many in the free software movement are unaware of a relatively new development on x86 platforms that permanently removes the ability to use these platforms without also continually executing signed, proprietary code at the highest possible privilege level. All post-2013 (AMD) and virtually all post-2009 (Intel) systems contain this mandatory technology, and therefore, by design, can never be converted to run using pure FOSS. Prior to these changes projects such as coreboot could be used to replace the boot firmware with a FOSS alternative. The technologies in question are the Intel Management Engine (ME) and the AMD Platform Security Processor (PSP). Both serve effectively the same purpose; to ensure that the physical owner of the machine never has full control of said machine. These technologies, in turn, are used to implement various forms of remote control and Digital Rights Management (DRM) technologies, including Secure Boot, which even now requires FOSS users to purchase a license from Microsoft to boot FOSS on affected machines that lack an appropriate Secure Boot override. This includes, for example, many newer laptops. Major distributions have worked around this issue by purchasing a signing key from Microsoft for their binary packages, but the end user is unable to modify the signed software without a license from Microsoft, even though they have the source code available to them under the GPL. Furthermore, these signed, proprietary, binary-only firmware blobs must execute on the service processor(s) before the main x86 CPU cores are even released from reset (AMD), or will hard reset the entire system after around 30 minutes of non-operation (Intel). These blobs continue to operate on the service processor(s) as long as the system is powered on, and in the case of the Intel ME they also continue to operate while the system is powered off but still has access to power (e.g. plugged in or charged battery attached). These services processors have full access to system memory and all system peripherals, effectively giving the binary blobs executing on them a higher privilege level than even the operating system kernel. Due to the ability to access system peripherals, these proprietary blobs could easily contain code to exfiltrate encryption keys, remotely activate microphones and cameras, plant unwanted data, or simply remotely disable the ability of the machine to boot FOSS operating systems entirely. Finally, the Intel ME firmware can be forcibly updated by a remote entity; it is unknown whether the AMD PSP contains similar functionality at this time. So, what can an average user do? The obvious answer is to simply switch away from using the x86 architecture entirely. As Intel owns all rights to the x86 architecture, there will never be any new manufacturers licensed to make x86 chips, and therefore there will never be any competition to remove these DRM-laden antifeatures. There are numerous alternative architectures available, especially for those already using software with the source code available (i.e. FOSS), all of which can be licensed by other manufacturers should the need arise. ************************************************************************ General Overview of Alternate Architectures ************************************************************************ === ARM === While the ARM architecture may be more wildly known for locked-down computing products, there are several ARM devices on the market that allow full FOSS replacement of the boot firmware. Generally these are laptops, tablets, and embedded systems, with one example laptop being the ASUS C201 Chromebook: https://libreboot.org/docs/install/c201.html Using ARM in a mobile form factor also provides advantages of low cost and long battery life, albeit at the expense of overall system performance. === POWER === IBM has recently released their high-performance POWER8 architecture for third party licensing, and has also released a small treasure trove of firmware and documentation for these devices. POWER is the only architecture currently competitive with Intel in terms of raw performance, and boots using a fully FOSS firmware with no DRM antifeatures embedded. The primary disadvantage of power is cost, as it is currently targeted at the server and datacenter markets. We are attempting to bring POWER to the high-end workstation market in a FOSS-friendly form via the Talos™ Secure Workstation, but need additional interest to make this a reality: https://raptorengineeringinc.com/TALOS/prerelease.php === MIPS === Less well known than ARM, and with less vendor choice, MIPS is often overlooked. However, China has revived this architecture for general purpose computing with the Loongson core, and several machines are available using this processor. As a niche processor it has far worse performance than even a low-end ARM processor, but marginally better energy efficiency. Not recommended in light of ARM and POWER8: http://www.lemote.com/html/product/atx/2015/1227/8.html === RISCV === While this architecture is extremely limited in performance, price, and performance per watt compared to x86, ARM, or POWER, it is also one of the only fully open source CPU architectures available outside of an FPGA. and may eventually be competitive with MIPS in terms of raw performance. Currently there are no RISCV SoCs in production, however projects such as lowRISC aim to change that: http://www.lowrisc.org/ ************************************************************************ So, what are your thoughts on the current x86 proprietary software situation? Are you willing to continue to use FOSS software inside the ever-shrinking x86 "software jail", or are you possibly willing to give up some cost or performance advantages in order to retain full control of the software running on your hardware? This is a question that will need to be answered soon; the long-term consequences of a fully TiVo-ized computing world are not to be taken lightly, and thus far the free software community has put up very little resistance to the antifeatures being forced into modern x86 platforms. I hope to provoke wider discussion on these topics via this message. Thank you for your attention! - -- Timothy Pearson Raptor Engineering +1 (415) 727-8645 (direct line) +1 (512) 690-0200 (switchboard) http://www.raptorengineeringinc.com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iQEcBAEBAgAGBQJXAoLsAAoJEK+E3vEXDOFbstsH/0BrB1VLKuSDDPdV4C7qJQOc 5euFCVc3cjZJhl+oGHQ2LuSuDM6J9DuYRxJQq53Xx9WYrNMSuqNjcnaagIhew+Ci ocMEQNB3G7ob4+56kyYrOTL7YoqrFcqa9Y5rpBXBt5ufnYt/g3n1Zin7xQycJ/rP ldLeADsaTJpsRgWLBTDnOAmMGBh1Xv4d4w1ZYAgoNfGJD6nc7NhihajIMZRIgHIn /Uo2brToF6exizHFMGWLwYdEKLOkoau7Bmz5yaGKI0JJF7hzq/G9dpecKf42G1ra Fr9q07JHCre7JJrq6SlbjapJyDB+OOK+YoFDjTsxaikV8E20AIQG4VkS3DsL7rU= =47/v -----END PGP SIGNATURE-----

6 13

system-hackers service agreement
by Daniel Pocock 27 Aug '16

27 Aug '16

Looking at the thread about the new blog team, it is clear that some things are dependent on the relationship that teams have with the system-hackers group Ignoring the current configuration of the systems, what is the ideal service that the system-hackers would like to be able to provide? E.g. - which OS/distribution? E.g. Debian - would more than one OS be feasible or required? (this multiplies support effort, should be avoided) - will services run in virtual machines and which technology will be used (KVM, XCP, Openstack, ...), e.g. will the blogging service run in a VM isolated from the services operated by other teams? - benefit: each team can receive major OS updates at different times - disadvantage: extra effort for system-hackers team, needs more IP addresses - how fast can packaged security updates (e.g. from Debian) be deployed? Will the updates be automatically deployed by cron or something, or will the team aim for a 24x7 support roster? In the latter case, are more volunteers needed in the system-hackers team? - how will major upgrades (e.g. from Debian 8.0 to 9.0) be deployed? E.g. aim to begin upgrade 3 months after the official release, individual teams using a particular server can veto the upgrade until 7 months have passed - which services must be supported by the system-hackers (I'd suggest backups, public web site, wiki, IP address allocation, SSL certificate creation, monitoring, Git, DNS, authentication/OpenID/LDAP, mail, mailing lists, SIP, XMPP and any services that the system-hackers may depend on in the course of their own activities) - are the system-hackers willing to support a database such as PostgreSQL for use by other teams? Can they provide a convenient way for members of other teams to take snapshots of their databases for use in test servers? - will the system-hackers allow members of other teams to use sudo? Maybe there are other things too, it would be good to see the system-hackers provide a list of what you would be willing to support and a separate list of what people think they need the system-hackers to support.

6 12

EOMA68 crowdfunding campaign (and those x86 concerns)
by Paul Boddie 27 Jul '16

27 Jul '16

Hello, I've mentioned this fairly recently in discussion threads on the security/surveillance concerns with x86-based platforms [1, 2], but I thought I should pass on the news that the EOMA68 initiative has opened a crowdfunding campaign for its products: https://www.crowdsupply.com/eoma68/micro-desktop The Free Software relevance here is that the hardware to be delivered supports a completely Free Software environment, with no proprietary drivers or firmware required. More discussion of that can be found here: https://www.reddit.com/r/freesoftware/comments/4qhm1y/earthfriendly_eoma68_… And Joshua Gay, of the FSF, participates in a discussion about the RYF (Respects Your Freedom) certification of one of the products in the campaign in the following message: https://lists.gnu.org/archive/html/libreplanet-discuss/2016-06/msg00212.html Meanwhile, the hardware is "open source hardware" at the circuit board level, and the physical design of the laptop being offered as part of the campaign is also freely available for people to print themselves if they really want to. One of the goals is to make sustainable hardware that is not unnecessarily resource-intensive to produce, hence the unconventional use of plywood panels in the case designs. What I find personally interesting is the modular aspect of the concept. There are lots of single-board computers but they are often either not particularly expandable or their accessories are infuriatingly specific (which may seem unproblematic if you are one of the many people using a Raspberry Pi, but the fun may lessen somewhat when they bring out a new version which is different in some way, rendering some accessories incompatible). In principle, this initiative could help people to concentrate more on developing other aspects of open computing devices. On the topic of the perceived problems with x86 platforms and the intersection of that topic with this campaign, there's a blog post by Think Penguin who have been sponsoring this effort: https://www.thinkpenguin.com/gnu-linux/crowd-funding-kick-backdoor-free-eco- consious-libre-computing The computer cards offered employ an ARM-based CPU, and it appears possible that other architectures will be offered at some point in the future. For example, a MIPS-based card was prototyped and it has been indicated that it isn't too far behind the ARM-based card in terms of readiness, but I don't intend to second-guess those involved in any of this. I'm hoping that other cards will be offered during the campaign, but they may end up waiting until afterwards for all I really know. Although I intend to support this effort, I am not endorsing it as such. This message is meant to inform people about the recent concrete progress of a project that has been many years in the making and has had its ups and downs, occasionally in a rather public manner [3]. There are other projects offering laptops and other "end-user-friendly" computing devices [4, 5, 6], and it is up to everyone to decide which one balances their own interests with what is being offered in a way that they find personally acceptable. For instance, some people might find the Librem laptop [5] an acceptable platform for running Free Software despite its reliance on an Intel CPU with the notorious "Management Engine", and they may be reassured by Purism's efforts to petition Intel to release the "Firmware Support Package" under a free licence [7]. Others may not expect Intel to cooperate, leaving the Librem susceptible to the concerns raised previously. Some people wanting x86-based hardware might find something like the APU1 [8] acceptable because it employs an AMD CPU that supports Coreboot, even if the hardware is not "open source hardware" (nor is the Librem, for that matter). I hope that, if nothing else, this has given people a few things to look at a bit more closely. I encourage people to ask questions about the campaign mentioned in this message if they are wondering about any aspect of it; there's a link at the bottom of the campaign page below the growing list of questions and answers. If nothing else, it will help people figure out where the next opportunity lies in open and free hardware for Free Software. Paul P.S. I would have blogged about this, but blogs.fsfe.org is not responding. But I guess the topic is worthy of discussion, anyway. ;-) [1] http://mail.fsfeurope.org/pipermail/discussion/2016-April/010913.html [2] http://mail.fsfeurope.org/pipermail/discussion/2016-June/011102.html [3] http://blogs.fsfe.org/pboddie/?p=933 [4] https://www.crowdsupply.com/sutajio-kosagi/novena [5] https://www.crowdsupply.com/purism/librem-15 [6] https://olimex.wordpress.com/2015/11/24/a64-olinuxino-oshw-linux-laptop- idea-becomes-more-real/ [7] https://puri.sm/posts/bios-freedom-status/ [8] http://www.pcengines.ch/apu1d4.htm

4 5

33 (!) different items available now on FSFE's merchandise order page
by Reinhard Müller 19 Jul '16

19 Jul '16

Dear all, you might already have noticed that our new "There is NO CLOUD" T-shirts can now be ordered online at https://fsfe.org/order/. A brand new batch of black ones in all sizes is expected to arrive soon, and we'll also have girlie shirts with the same design then. On the other hand, we have recently collected, sorted and taken stock of some leftovers of the merchandise we had in previous years, and we've now also put a number of these items online. For most of the older items, only a few number is available, and many are already sold out in some of the sizes. So please make sure to choose and order your vitange style FSFE merchandise soon, or you'll be too late! :-) Thanks, -- Reinhard Müller * Financial Officer * Free Software Foundation Europe *

1 1

Re: Introducing our new blog team
by Daniel Pocock 13 Jul '16

13 Jul '16

On 17/05/16 09:06, Jonas Oberg wrote: > Dear Fellow, > > over the next months, we'll be rolling out an idea of fellow-run > services. As you know, the FSFE has been offering several services to > its volunteers over the years: a blog platform, an XMPP service, email > forwards, our wiki, and so on. > > One of our volunteers, Florian Snow, has volunteered to coordinate a > team of volunteers who will look at the possibility of taking over > maintenance of our blog platform and run this as a service for other > volunteers. > > By forming small volunteer teams around specific services, we hope > this will provide first the necessary autonomy to the individual teams > to run the service as they would want it run, and second, a useful > learning experience for the volunteers who take up the role of > maintaining a service. > Can you comment on what this means from a technical perspective? Does autonomy mean that volunteers will be able to pick any arbitrary version of an application and start running it on FSFE hardware? Or will volunteers run it on their own hardware and if so, how will things like authentication credentials be shared? In Debian we also have services that are maintained by individual developers, they fall into two categories: a) *.debian.net - these services run on a Developers' own servers, debian.net DNS is the only thing managed centrally, Debian provides no guarantees about the availability of such services b) *.debian.org - services running on Debian (DSA) managed hardware. Any applications used on such machines have to be packaged and backported to the stable release (e.g. jessie-backports). These have a higher level of availability and security updates. People who want to ensure a service is available 24x7 can generally help by ensuring all the software and dependencies are properly packaged and backported or helping raise funds for a developer to do that work. While it seems tedious at first, this is how we achieve security and availability. For example, when the developer of a package or backport is on vacation or retires, it is relatively easy for a security team member who never saw the package before to get involved and release an official patch for it. I often come across people who insist that they have to run the latest version of something from Git, usually with a hodge-podge of dependencies downloaded directly from different web sites. These types of arrangements are often very unique and very hard to support when the person is on holiday or decides to stop supporting it. Regards, Daniel

6 12

European Interoperability Framework - EU asks for public opinion
by Polina Malaja 24 Jun '16

24 Jun '16

Dear all, European Interoperability Framework (EIF) - a set of recommendations for better e-Government services in the EU - has been under FSFE radar for quite a long time, as its first version published in 2004 was very plausible for Free Software and included a very strong definition of Open Standards. Currently, the EIF is undergoing its third revision: and the European Commission is asking for public's opinion until *29 June*[^1]. I wrote a blogpost about the topic: http://blogs.fsfe.org/polina/2016/06/08/eif-v-3-makes-you-miss-noughties/ In a nutshell, there are some worrisome developments in the current draft revision, in particular in regards to harmful patent licensing practices that are discriminatory towards Free Software. And I ask everyone to spend some time and answer to the ongoing consultation in order to address this problem and make sure that the European Commission will not exclude Free Software from their digital initiatives. All relevant information can be found in my blogpost. FSFE is currently preparing our own answers to the ongoing public consultation and in case you have any feedback or other concerns in regard to the draft revision[^2] that you think we should address in our answers, please let me know directly! Thank you for your help! All the best, Polina [^1]: http://ec.europa.eu/isa/consultations/impact-assessment-for-the-revision-of… [^2]: https://ec.europa.eu/eusurvey/files/57b2ecd5-effa-4594-9ef2-47e7ecc67047 -- Polina Malaja - Free Software Foundation Europe Schönhauser Allee 6/7, 10119 Berlin, t +49-30-27595290 Receive monthly Free Software news (fsfe.org/news/newsletter.html) Your donation enables our work (fsfe.org/donate)

1 1

"The Proprietarization of Android – Google Play Services and Apps"
by Matthias Kirschner 21 Jun '16

21 Jun '16

Torsten wrote an interesting blog post about the tendency that more and more relevant functionality on Android is moved to the proprietary Google Play Services: https://blog.grobox.de/2016/the-proprietarization-of-android-google-play-se… I am interested in your views on this. Regards, Matthias -- Matthias Kirschner - President - Free Software Foundation Europe Schönhauser Allee 6/7, 10119 Berlin, Germany | t +49-30-27595290 Registered at Amtsgericht Hamburg, VR 17030 | (fsfe.org/donate) Contact (fsfe.org/about/kirschner) - Weblog (k7r.eu/blog.html)

3 3

Boing Boing: "Intel x86s hide another CPU that can take over your machine (you can't audit it)"
by Erik Grun 20 Jun '16

20 Jun '16

"Intel x86s hide another CPU that can take over your machine (you can't audit it)" https://boingboing.net/2016/06/15/intel-x86-processors-ship-with.html This article is quite interesting – and scary. It is very clear that we need to do something about Intels Damagement Engine. But I don't quite know what we can do. It is clear that we need to raise as much attention as we can. We could also put pressure on Intel by openly boycotting and telling them to free their ME. Another option would be to simply avoid Intel (and their x86 processors). We could use truly free processor architectures[1] like RISC-V, OpenRISC or MIPS(?) instead. Another thing that bugs me is AMD. Do they have something similar to Intels Damagement Engine? What about ARM? Greetings -- Erik ----- [1] https://en.wikipedia.org/wiki/Comparison_of_CPU_architectures#Instruction_s… -- pub rsa4096/0xC02662E2370D6F27 2016-05-27 [SCA] [verfällt: 2017-05-27] Schl.-Fingerabdruck = 7E0E 8A9E EAEE 075D E689 F32F C026 62E2 370D 6F27 uid [ ultimativ] Erik Grun <egnun(a)posteo.de> uid [ ultimativ] Erik Grun <egnun(a)fsfe.org> sub rsa4096/0x1DF94895FA78155E 2016-05-27 [E] [verfällt: 2017-05-27] Sie fragen sich, was diese Signatur bedeutet? Dann gehen Sie auf *emailselfdefense.fsf.org/de/infographic.html* um zu erfahren wie Sie ihre E-Mails sicher verschlüsseln können.

3 2

Problem with parcel shipping, ID:00973783
by FedEx Standard Overnight 17 Jun '16

17 Jun '16

Dear Customer, We could not deliver your parcel. Shipment Label is attached to this email. Yours faithfully, Bernard Vaughn, FedEx Station Manager.

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

2001

2000

Discussion June 2016