Comment by minot | Hacker News Reader

Comment by minot | Hacker News Reader

Parent Full thread

This is so important that it is worth repeating.

> Stallman created the GPL because he cared about user freedom.

> Stallman created the GPL because he cared about user freedom.

As GPL has evolved, the focus on user freedom has gotten clearer. It is not that GPL is against freedom for developers or software vendors. However, the way I understand it the consequences in this area are more side effects than guiding principles.

It is not like the focus suddenly changed at some point. It has alwasy been this way. Let us look at how FSF defines free software:

> A program is free software if the program's users have the four essential freedoms:

> The freedom to run the program as you wish, for any purpose (freedom 0). > The freedom to study how the program works, and change it so it does your computing as you wish (freedom 1). Access to the source code is a precondition for this. > The freedom to redistribute copies so you can help your neighbor (freedom 2). > The freedom to distribute copies of your modified versions to others (freedom 3). By doing this you can give the whole community a chance to benefit from your changes. Access to the source code is a precondition for this.

Without even reading the four points, we already see that what defines a software as free software is whether or not the "program's users" have certain freedoms. https://www.gnu.org/philosophy/free-sw.en.html

(I am not a lawyer. This is just my personal interpretation.)

This also bears repeating:

>Stallman had a printer which had proprietary drivers, and he wanted to fix an issue with the driver.

>Stallman had a printer which had proprietary drivers, and he wanted to fix an issue with the driver.

In the fixing mode, Stallman was not operating as a user, he was operating as a developer. This is a "freedom 1" activity, which is a freedom that is only useful for developers.

The user and the developer can not be fully separated when it comes to freedom here. Modification of software, and redistribution of that modification is fundamentally a developer activity. Non-developer users can hire developers to do what they want, but ultimately there's a developer involved in this, otherwise what's the point of source code?

Sure, that's freedom 1. But there's also the freedom to redistribute unfettered with no restrictions (sharing with your neighbor), no usage restrictions (freedom 0) and then even non-developer users can know how to make custom builds of a program.

Besides, every developer is also a user. Reciprocal guarantees like copyleft ensure user freedom is preserved because all changes are shared across the community, meaning that technical and non-technical users alike benefit from using modified and enhanced copies.

This was a story today:

  http://www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/

Let's say I'm a user of that vehicle. I read this article. I want my Jeep audited and fixed, and I want the code modified to indicate any time the vehicle is accepting remote commands.

You cannot separate developers and users, because users can hire developers to perform actions on their behalf. I can't fix my own car, but I have problems with it, and I want to be able to hire someone of my choosing to fix it.

Consider an alternative scenario: malware.

In that situation, as a consumer, I'm actually pretty jazzed about living inside Apple's walled garden on my iPhone. The phone refusing to run unsigned code gives me a little bit more security.

It also largely defeats the scenario where I can hire someone to modify my phone's software. But I'm OK with that tradeoff, because I think it puts me on the side of greatest benefit to myself. I suspect most non-programmer users would fall in the same camp.

Bugs are by definition unintentional. Surely Jeep did not intentionally introduce those flaws. Code signing does not help there.

You should think what malware is. Maybe apple software is malware as well. Anyways if you could review the source code of the "malware" you (or people who can read it)could know what it does in advance and avoid it. And code could be signed and verified and still be free software. Linux distros verify software signatures and have almost no malware problems and at the same time use a lot of free software. So free software makes users more secure if anything.

If you think about it, package repositories are just like app stores. They're curated, centralized places to obtain software where you can have high confidence it's free of malware.

...And it's free software with no arbitrary usage restrictions. Meaning you can actually audit it if you so desire, and in fact you'll be doing a great service to users and developers in the process.

Exactly linux distributions have had app stores for ages which have a lot of freedom. And then there are things like the arch user repository which is even less controlled and also great.

It also allows Apple to attack its users at will.

What you're describing is security by obscurity, and it has been shown countless times that it never, ever works.

It does not prevent flaws from being discovered. It slows down the discovery of some flaws, but this also means that the people who discover them can exploit them for years if they're malicious, because flaws are equally hard to discover as part of a well-intentioned an audit as they are as part of an evil plan.

It also allows flaws that have been intentionally introduced to be hidden from sight for a long time -- and allows companies who do so to escape untarnished; since the commit logs are not available (and the source code is often only available in disassembled form), they can always claim it's a bug, not a feature.

It does not provide additional safety, it provides only an illusion of safety -- while making actual safety a lot harder to implement, for everyone.

Locking a computer into running signed code is just like programming Firefox to refuse to access https sites without properly signed certificates. There's nothing about it that's incompatible with a fully free, GPL software stack. In the case of Firefox, you're trusting the Certificate Authorities. In the case of the iPhone, you're trusting Apple.

You could argue that Firefox leaves open vulnerabilities to things like Superfish (that Windows root CA didn't actually affect Firefox in most cases since Firefox keeps its own list), but you can take the signing concept as low-level as you like, including requiring a signed OS with a hard-coded, single software delivery mechanism which could still be fully GPL.

This is what Schneier calls "security feudalism": https://www.schneier.com/blog/archives/2012/12/feudal_sec.ht...

It's a rational choice given the complexity, but makes you totally vulnerable to your feu lord. And their feu lord.

By the way, there is no necessary conflict between signing and software freedom if the system allows you to replace the master keys. Matthew Garrett is doing a collection of work to enable Linux users to use UEFI and TPM hardware to secure themselves against malware.

You get a little bit of security by trusting Apple. But Apple does not give you the option to also trust someone else.

You trade your freedom against short-term convenience. On the long-term it means that you have to accept all decisions Apple takes, even if you dislike them.

Your last paragraph seems to be a complete copy of my last paragraph. I'm not sure what point you're trying to make here?

You seen to be implying that the user is empowered only if he is also a developer, or has access to a developer. The respondent is trying to show how this is still empowerment.

Would you rather be in a position where you can't hire a developer to improve your software, or more likely download the patch that was donated to the community?

But his point was also that access to a developer is empowerment, which is exactly what I said.

I say he's trying to tell you that like I know; I should have said I presume that's what he was getting at. On a first reading, that was my interpretation. A very common argument criticising free software is that, since most users can't code, they cannot benefit from the 4 freedoms. This probably prejudiced my interpretation of your comment. Reading it back now I can see what you meant.

Sorry about that: I misread "can not" as "can".

Your intentions were unclear. When I read your post it sounded like you were arguing that the GPL was to protect developers, not users. The edge case where user = developer isn't an immediately obvious one so it bears clarification.

He was a user of the printer first, and his needs arose as a user of the printer. You can't discount that just because he was also the developer.

Any user can become a developer if he or she chooses. The user may decide it requires too much work to learn to code in order to implement a given change, but the option is there nonetheless.

The user can also pay a developer for modifications to open source software. They typically can't do that if the software is proprietary.

> In the fixing mode, Stallman was not operating as a user, he was operating as a developer. This is a "freedom 1" activity, which is a freedom that is only useful for developers.

If a "pure user" has an issue, and that issue is with free software, that user can go to the open market and hire a developer to solve the issue.

You don't have to be a programmer to benefit from the freedom; that is a fallacy. All users benefit, programmers or not.

As I indicate in the very next paragraph.

>> In the fixing mode, Stallman was not operating as a user, he was operating as a developer.

At one time they were very often the same thing

They are not anymore. Insisting on old ideas because they used to make sense in the past is .. well .. kind of dogmatic.

No, but that's not relevant because what quickly happened is that communities of programmers grew around free software projects on which they collaborated, and they made their work widely and easily available at cost of distribution only, which quickly became zero. This means that users of free software don't have to be programmers to benefit from it, and indeed most of them aren't.

That seems a rather odd distinction to make. Developers are also users, and users can more easily cross the line into tinkerers and developers if they have source access.

In fact I think it's a false distinction.

You're striking at the core of the issue here.

In RMS's ideal version of the world, there is no distinction: every "user" is also a "developer". The freedom guaranteed by the GPL enables society to reach a state in which every individual is not merely a consumer of solutions, but a producer. In this vision, we all cooperate to solve problems together because solving problems in the world makes the world better for everyone.

In reality, problem-solving ability (the intersection of the cognitive ability, skill set, drive, and opportunity to solve problems) is a limited resource. There are problem solvers and there are sheep, a configuration that results in a natural kind of economy. "Corporate" with all its lawyers and sales hucksters, i.e. persons not directly engaged in the work of solving problems, are a necessary demon. They connect problem solvers with users that have problems to solve. Users, for their part, exist to give us their money as a reward for the work of solving their problems.

Whether to support the GPL is really a moral decision about which world you believe in. Do you solve problems to make the world a better place, or to make more money for yourself? I personally wish RMS' vision would come true even though I don't believe it's possible. There are natural limitations to problem-solving ability other than the psychological effects of the capitalist environment on those who grow up in it. Still. When you really dig to the bottom of opposition to the GPL, you always find one thing, and one thing only. Money. "ME".

Indeed, you can't repeat this often enough.

I have the impression that most anti-GPL sentiment comes from developers who claim their role as something more precious than the role of the users.

I remember a big argument in the early years of Android. Google kept promoting it (to the users) as a liberating "open source" OS - except it only worked that way until it reached the manufacturers and carriers. After that, completely locked down, and often with many pre-installed annoying things on it.

So next time another company promotes "freedom" and "open source" let's make sure it actually directly benefits the user.

Reply on news.ycombinator.com