Discussion August 2016

discussion@lists.fsfe.org

24 participants
23 discussions

Please help us spread the word on Roundcube Next
by Georg C. F. Greve 29 May '17

29 May '17

Dear all, In the spirit of full disclosure, let me start by pointing out that I am CEO and - along with other employees, some of whom you will also know - shareholder of Kolab Systems AG (https://kolabsystems.com) and that Kolab Systems has been the driving force behind Roundcube for the past years. Kolab Systems has also agreed to help the Roundcube Next team in its aim to refactor and build the next technology generation. So I am not neutral. That said, I genuinely believe it is extremely important for the Free Software community to get behind Roundcube Next and help us push it forward, as well as bring others on board with it. The longer story is here: http://blogs.fsfe.org/greve/?p=676 TL;DR, Part I: As a community we *require* technologies that compete with Google Apps, Office 365 and the likes in features, convenience, UI/UX, yet provide full control and freedom to users. TL;DR, Part II: Application Service Providers should get on board with that push *right now* because otherwise they will find themselves forced into becoming re-sellers for Office 365 and Google Apps -- and increasingly unable to compete with their features & networking effects. Some already understood this, and have joined the Roundcube Next community, such as cPanel (http://blog.cpanel.com/on-to-the-next/), Tucows, and now also Fastmail (http://blog.fastmail.com/2015/06/05/fastmail-supports-roundcube-next-develo…). But there are many more providers using Roundcube today who have not joined, nor have they contributed in the past. For them it should be obvious to join. And then there are those that have their own home-brew interfaces (such as Fastmail) who get the unique opportunity to become part of a new, growing community that will create a technology that will make them fully competitive against the "big clouds" in 18 months from now. Unfortunately, most of them have not realized this yet. So unless your provider is cPanel, Tucows, Fastmail or Kolab Now, all of who are part of this already, please encourage them to step up and join the community to push for Roundcube Next. Direct link for your convenience: https://www.indiegogo.com/projects/roundcube-next--2/x/4658765#/story Best regards, Georg -- Georg C. F. Greve <greve(a)fsfeurope.org> Member of the General Assembly http://fsfe.org/about/greve/ http://blogs.fsfe.org/greve/ http://identi.ca/greve

8 17

Article "FRAND And The Clash Of Industries"
by Matthias Kirschner 28 Nov '16

28 Nov '16

Dear all, Simon (in CC) wrote an article "FRAND And The Clash Of Industries". https://meshedinsights.com/2016/07/12/frand-clash-of-industries/ We would be interested in feedback about it. (This is related to the article "Why is FRAND bad for Free Software?" <https://fsfe.org/activities/os/why-frand-is-bad-for-free-software.en.html>) Regards, Matthias -- Matthias Kirschner - President - Free Software Foundation Europe Schönhauser Allee 6/7, 10119 Berlin, Germany | t +49-30-27595290 Registered at Amtsgericht Hamburg, VR 17030 | (fsfe.org/donate) Contact (fsfe.org/about/kirschner) - Weblog (k7r.eu/blog.html)

3 4

Uncorrectable freedom and security issues on x86 platforms
by Timothy Pearson 25 Oct '16

25 Oct '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 All, It has recently come to my attention that many in the free software movement are unaware of a relatively new development on x86 platforms that permanently removes the ability to use these platforms without also continually executing signed, proprietary code at the highest possible privilege level. All post-2013 (AMD) and virtually all post-2009 (Intel) systems contain this mandatory technology, and therefore, by design, can never be converted to run using pure FOSS. Prior to these changes projects such as coreboot could be used to replace the boot firmware with a FOSS alternative. The technologies in question are the Intel Management Engine (ME) and the AMD Platform Security Processor (PSP). Both serve effectively the same purpose; to ensure that the physical owner of the machine never has full control of said machine. These technologies, in turn, are used to implement various forms of remote control and Digital Rights Management (DRM) technologies, including Secure Boot, which even now requires FOSS users to purchase a license from Microsoft to boot FOSS on affected machines that lack an appropriate Secure Boot override. This includes, for example, many newer laptops. Major distributions have worked around this issue by purchasing a signing key from Microsoft for their binary packages, but the end user is unable to modify the signed software without a license from Microsoft, even though they have the source code available to them under the GPL. Furthermore, these signed, proprietary, binary-only firmware blobs must execute on the service processor(s) before the main x86 CPU cores are even released from reset (AMD), or will hard reset the entire system after around 30 minutes of non-operation (Intel). These blobs continue to operate on the service processor(s) as long as the system is powered on, and in the case of the Intel ME they also continue to operate while the system is powered off but still has access to power (e.g. plugged in or charged battery attached). These services processors have full access to system memory and all system peripherals, effectively giving the binary blobs executing on them a higher privilege level than even the operating system kernel. Due to the ability to access system peripherals, these proprietary blobs could easily contain code to exfiltrate encryption keys, remotely activate microphones and cameras, plant unwanted data, or simply remotely disable the ability of the machine to boot FOSS operating systems entirely. Finally, the Intel ME firmware can be forcibly updated by a remote entity; it is unknown whether the AMD PSP contains similar functionality at this time. So, what can an average user do? The obvious answer is to simply switch away from using the x86 architecture entirely. As Intel owns all rights to the x86 architecture, there will never be any new manufacturers licensed to make x86 chips, and therefore there will never be any competition to remove these DRM-laden antifeatures. There are numerous alternative architectures available, especially for those already using software with the source code available (i.e. FOSS), all of which can be licensed by other manufacturers should the need arise. ************************************************************************ General Overview of Alternate Architectures ************************************************************************ === ARM === While the ARM architecture may be more wildly known for locked-down computing products, there are several ARM devices on the market that allow full FOSS replacement of the boot firmware. Generally these are laptops, tablets, and embedded systems, with one example laptop being the ASUS C201 Chromebook: https://libreboot.org/docs/install/c201.html Using ARM in a mobile form factor also provides advantages of low cost and long battery life, albeit at the expense of overall system performance. === POWER === IBM has recently released their high-performance POWER8 architecture for third party licensing, and has also released a small treasure trove of firmware and documentation for these devices. POWER is the only architecture currently competitive with Intel in terms of raw performance, and boots using a fully FOSS firmware with no DRM antifeatures embedded. The primary disadvantage of power is cost, as it is currently targeted at the server and datacenter markets. We are attempting to bring POWER to the high-end workstation market in a FOSS-friendly form via the Talos™ Secure Workstation, but need additional interest to make this a reality: https://raptorengineeringinc.com/TALOS/prerelease.php === MIPS === Less well known than ARM, and with less vendor choice, MIPS is often overlooked. However, China has revived this architecture for general purpose computing with the Loongson core, and several machines are available using this processor. As a niche processor it has far worse performance than even a low-end ARM processor, but marginally better energy efficiency. Not recommended in light of ARM and POWER8: http://www.lemote.com/html/product/atx/2015/1227/8.html === RISCV === While this architecture is extremely limited in performance, price, and performance per watt compared to x86, ARM, or POWER, it is also one of the only fully open source CPU architectures available outside of an FPGA. and may eventually be competitive with MIPS in terms of raw performance. Currently there are no RISCV SoCs in production, however projects such as lowRISC aim to change that: http://www.lowrisc.org/ ************************************************************************ So, what are your thoughts on the current x86 proprietary software situation? Are you willing to continue to use FOSS software inside the ever-shrinking x86 "software jail", or are you possibly willing to give up some cost or performance advantages in order to retain full control of the software running on your hardware? This is a question that will need to be answered soon; the long-term consequences of a fully TiVo-ized computing world are not to be taken lightly, and thus far the free software community has put up very little resistance to the antifeatures being forced into modern x86 platforms. I hope to provoke wider discussion on these topics via this message. Thank you for your attention! - -- Timothy Pearson Raptor Engineering +1 (415) 727-8645 (direct line) +1 (512) 690-0200 (switchboard) http://www.raptorengineeringinc.com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iQEcBAEBAgAGBQJXAoLsAAoJEK+E3vEXDOFbstsH/0BrB1VLKuSDDPdV4C7qJQOc 5euFCVc3cjZJhl+oGHQ2LuSuDM6J9DuYRxJQq53Xx9WYrNMSuqNjcnaagIhew+Ci ocMEQNB3G7ob4+56kyYrOTL7YoqrFcqa9Y5rpBXBt5ufnYt/g3n1Zin7xQycJ/rP ldLeADsaTJpsRgWLBTDnOAmMGBh1Xv4d4w1ZYAgoNfGJD6nc7NhihajIMZRIgHIn /Uo2brToF6exizHFMGWLwYdEKLOkoau7Bmz5yaGKI0JJF7hzq/G9dpecKf42G1ra Fr9q07JHCre7JJrq6SlbjapJyDB+OOK+YoFDjTsxaikV8E20AIQG4VkS3DsL7rU= =47/v -----END PGP SIGNATURE-----

6 13

system-hackers service agreement
by Daniel Pocock 27 Aug '16

27 Aug '16

Looking at the thread about the new blog team, it is clear that some things are dependent on the relationship that teams have with the system-hackers group Ignoring the current configuration of the systems, what is the ideal service that the system-hackers would like to be able to provide? E.g. - which OS/distribution? E.g. Debian - would more than one OS be feasible or required? (this multiplies support effort, should be avoided) - will services run in virtual machines and which technology will be used (KVM, XCP, Openstack, ...), e.g. will the blogging service run in a VM isolated from the services operated by other teams? - benefit: each team can receive major OS updates at different times - disadvantage: extra effort for system-hackers team, needs more IP addresses - how fast can packaged security updates (e.g. from Debian) be deployed? Will the updates be automatically deployed by cron or something, or will the team aim for a 24x7 support roster? In the latter case, are more volunteers needed in the system-hackers team? - how will major upgrades (e.g. from Debian 8.0 to 9.0) be deployed? E.g. aim to begin upgrade 3 months after the official release, individual teams using a particular server can veto the upgrade until 7 months have passed - which services must be supported by the system-hackers (I'd suggest backups, public web site, wiki, IP address allocation, SSL certificate creation, monitoring, Git, DNS, authentication/OpenID/LDAP, mail, mailing lists, SIP, XMPP and any services that the system-hackers may depend on in the course of their own activities) - are the system-hackers willing to support a database such as PostgreSQL for use by other teams? Can they provide a convenient way for members of other teams to take snapshots of their databases for use in test servers? - will the system-hackers allow members of other teams to use sudo? Maybe there are other things too, it would be good to see the system-hackers provide a list of what you would be willing to support and a separate list of what people think they need the system-hackers to support.

6 12

IRC cloaks on Freenode available
by Jonas Oberg 26 Aug '16

26 Aug '16

Dear all, if you're a Freenode user, perhaps regularly a part of our #fsfe channel, you now have the option of getting an FSFE-affiliated cloak. For those of you who don't know, an IRC cloak is a replacement for your IP number or domain name when people query your name on IRC, so instead of showing up as "jonas(a)192.243.8.174" (as an example), you'd show up as "jonas@fsfe/jonas" [^1]. I documented this here: https://wiki.fsfe.org/TechDocs/FellowshipServices#IRC If you want a cloak, you need to have a NickServ registered name, an FSFE account (by being a Fellow or a volunteer[^2]), and you need to let me know you want one: I'll communicate this to the Freenode staff which will activate your cloak. AS there may be quite a few cloak requests in the beginning, I'll collect requests and send to Freenode on a ~weekly basis. [^1]: Please note though that a cloak while giving some privacy does not give you perfect privacy and it's generally not much of a problem for someone to figure out your IP address anyway. [^2]: See https://wiki.fsfe.org/TechDocs/AccountCreation for more information. -- Jonas Öberg, Executive Director Free Software Foundation Europe | jonas(a)fsfe.org Your donation enables our work (fsfe.org/donate)

1 0

EOMA68 crowdfunding campaign (the last few days) plus ways forward for Libre Computing
by Paul Boddie 25 Aug '16

25 Aug '16

Hello, I last mentioned EOMA68 on this list in early July, noting that I would have blogged about it, too, but couldn't at the time. Unfortunately, real life got in the way of either following up with the blog volunteers about the blogging service (which I greatly appreciate as a service of the FSFE Fellowship) or actually writing anything about this topic on my blog. In fact, I only wrote about it there recently: https://blogs.fsfe.org/pboddie/?p=1314 (Reminder: EOMA68 is a standard for modular plug-in computer cards; the campaign offers one kind of card with different operating system choices, plus some devices that can use the card.) Once again, I may have pledged for rewards in the campaign, but I'm not explicitly endorsing it. Everyone should weigh up the different factors and their own needs when supporting such efforts. However, it is worth noting that there are only 4 days left until the campaign ends: https://www.crowdsupply.com/eoma68/micro-desktop (Here, I am only repeating this because maybe other people had real life intervene on them in July and August, too.) There has been a range of responses from enthusiasm about the modular computing concept and support for hardware that fully supports Free Software through to criticism about the performance and the ethical record of the system-on-a-chip vendor that happens to be used for the first card. Reading some of the responses, I note that maybe there is some kind of law of public discourse that the more severe the criticism, the less constructive it tends to be. On this list, there was a discussion about how bad modern x86 derivatives are by enabling surveillance at the hardware level... http://mail.fsfeurope.org/pipermail/discussion/2016-April/010912.html ...but either people feel completely powerless about it or they like to talk about the situation more than how to alleviate or resolve the situation. Amusingly, all sorts of observations came up about that discussion and I even mentioned one of them here: https://blogs.fsfe.org/pboddie/?p=1305 (Yes, SPARC might even be a candidate for an alternative hardware platform, but its supporters need to bring finance and people to the effort instead of reminiscing about Sun's glory days. The referenced discussion is, however, rather interesting to read in parts.) Now, I saw a couple of responses to my previous message, combining the EOMA68 topic with the surveillance topic - SPARC even got a mention! - but maybe July is not a month in which much discussion tends to take place. But I feel that there does need to be a proper discussion about the way forward for Libre Computing (Free Software on Libre Hardware) and how the various communities can deliver sustainable platforms: * Whether EOMA68 (and its siblings) or something similar (see next point) has a role to play in this, perhaps only as a step towards the eventual goal of a set of platforms we can rely on * Whether there are other ongoing efforts in this area (not one-offs) that just need more attention than they have been getting * Whether or when libre CPUs and SoCs might be viable choices for such platforms * Whether some existing products are good-enough choices for hardware platforms, even if they are not libre hardware or employ encumbered microarchitectures (which a lot of established products do, of course) There's an interesting summary of processor suitability done for the criteria of EOMA68 that some might find interesting: https://www.crowdsupply.com/eoma68/micro-desktop/updates/picking-a-processor "It should also be pretty clear that there is literally not a single processor that checks every single box! As in, there is not a single processor in the world that is eco-conscious, respects software freedom, is ethical and accessible. This is a pretty insane situation to be in, in the year 2016." There needs to be a constructive debate about incrementally improving this situation. Instead of "I hate that processor" or "wait for my radical SoC I've just started designing", people need to help find products that uphold software freedom and privacy while also being usable (obtainable, for the most part) for small libre hardware projects. And there needs to be an appreciation that this work is not meant to create the "toy of the month" - a gadget that is fun for a while and then stashed away somewhere - but instead to build an environment where we shouldn't be constantly needing to urgently figure out what kind of hardware we can use that uphold our values. So, does anyone have any opinion about the kinds of projects (most likely being undertaken already) that need our attention or support? How do you envisage a sustainable computing platform? And since all discussions inevitably lament how much memory Firefox uses these days, how do you envisage a less demanding form of computing being extended to online services? Sorry for the long message! Paul

3 5

easy stuff
by phil 25 Aug '16

25 Aug '16

Greetings! I've found a very easy tutorial on the stuff we were talking about, look here <http://rdishavishi.jasonbeyer.com/lnheqlb> Regards, phil

1 0

Take part! Freedom not Fear 2016: 14–17 October, Brussels
by Friedemann Ebelt 24 Aug '16

24 Aug '16

please announce on discussion(a)lists.fsfe.org, merci Friedemann! ------------ Dear fellow activists, take part in Freedom not Fear 2016: Hold a session on free software etc., mark your calendar now and spread the word: Freedom not Fear 2016 is looking forward to your projects, your campaign and your session. Meet NGOs and activists from all over Europe and take action for digital human rights. Join us in Brussels, we also try to help you with accommodation and such. Freedom not Fear 2016 14-17 October 2016 (Friday-Monday) Mundo B, Rue d'Edimbourg 26, BXL https://www.freedomnotfear.org – program & schedule is work in progress: https://wiki.vorratsdatenspeicherung.de/Freedom_Not_Fear_2016/Schedule_here – Register for travel allowances now! https://www.freedomnotfear.org/2016/registration-travel-allowances Everybody is welcome to take part, help organise and support Freedom not Fear 2016! Friedemann Ebelt ------------------------------------------------ More information on Freedom not Fear 2016 https://edri.org/freedom-not-fear-2016/ ------------------------------------------------ Freedom not Fear (FNF) is an annual meeting for civil rights activists from all across Europe. You are invited to join us on 14-17 October, organise discussions on your own topics, and use this opportunity to meet EU politicians! At FNF, civil society members meet in Brussels for four days to work for freedom in the digitised world. They plan for and engage in action against increasing surveillance and other attacks on civil rights. FNF 2016 is organised by volunteers and coordinated by EDRi member Digitalcourage and via the akv-international mailing list. >From Friday 14 October to Sunday 16 October, activists meet at Mundo-b to discuss current topics in European data protection, surveillance and more. Topics already planned include surveillance law metrics, the so-called Privacy Shield, biometric RFID passports, the reform of the ePrivacy Directive, and proposed EU contract law. On Monday 17 October, a visit to the EU Parliament is being organised for meetings with Members of European Parliament (MEPs) and European Commission staff. Participants who stay on for the Monday visit are eligible for travel allowances sponsored by MEPs Julia Reda, Jan Philipp Albrecht and Josef Weidenholzer. For those wanting to benefit from these travel allowances, Digitalcourage has set up an online registration page. FNF is still looking for volunteers to take on organisational tasks, suggest and run discussions, propose and organise MEP meetings, and more. People wanting to help can simply edit the FNF 2016 wiki pages hosted by AK Vorrat, or contact Digitalcourage by e-mail. Joining the akv-international mailing list is also encouraged. Freedom Not Fear website https://www.freedomnotfear.org/ Wiki pages for FNF 2016 https://wiki.vorratsdatenspeicherung.de/Freedom_Not_Fear_2016 akv-international mailing list https://listen.akvorrat.org/mailman/listinfo/akv-international Venue: Mundo-b on OpenStreetMap http://www.openstreetmap.org/way/139078492 Register online for travel allowances and accommodation https://aktion.digitalcourage.de/fnf2016-en E-mail contact contact(a)freedomnotfear.org -- Friedemann Ebelt | Redaktion | Kampagnen Digitalcourage e.V., Marktstr. 18, D-33602 Bielefeld https://digitalcourage.de/ | http://bigbrotherawards.de/ Vorratsdatenspeicherung? Nicht schon wieder! Unterstützen Sie unsere Verfassungsbeschwerde: https://digitalcourage.de/weg-mit-vds

1 0

FOSSA
by David VANTYGHEM 23 Aug '16

23 Aug '16

Hello, About https://joinup.ec.europa.eu/community/eu-fossa/news/ec-audit-apache-http-se… Why choosing KeePass and not KeePassX ? KeePass is using the .NET Framework. If you find security holes in .NET, it will be impossible to remove them. KeePass is not really multi-platform. KeePassX is really multi-Plateform and proprietary software independant. https://www.keepassx.org -- David VANTYGHEM Mél. : david.vantyghem(a)free.fr diaspora* : https://framasphere.org/u/albator57 .--. |o_o | ||_/ | // \\ Envoyé avec GNU/Linux (| |) / \_ _/ \ \___)=(___/

3 2

When will you leave after the summit?
by Florian Snow 22 Aug '16

22 Aug '16

Hi everyone, I am currently in the process of doing the final scheduling for my trip to Berlin and since the talks are over shortly after 3 pm on Sunday, I was wondering whether it still made sense to stay until Monday. So I guess the question is what are you going to do? If there is a sufficient number of people who are staying until Monday, I am sure there will be activities we can do together on Sunday night. So for the sake of scheduling, please let me know on this list. :-) Happy hacking! Florian

3 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

2001

2000

Discussion August 2016