subject:"The Spirit of Free Software, or The Reality"

* Bas Wijnen:

 I disagree that the safebrowsing part is not serious, especially
 considering that it continues to send a message there on every new
 page you visit.

That's not what should happen.  Google can essentially make Iceweasel
do that by serving appropriate static data instructing the browser to
do so, but it should not happen in practice.


-- 
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: https://lists.debian.org/87y4ich1wa@mid.deneb.enyo.de

Re: The Spirit of Free Software, or The Reality

* Paul Wise:

[Safe Browsing]

 Why doesn't it just download the full list and do checks client-side?

The contents of this list is proprietary.  Google might not even own
it (or parts of it).  There may also be a need for operational secrecy
for such technology.

Publishing the list would also increase liability for Google because
it is easier to spot third parties whose rights are violated.


-- 
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: https://lists.debian.org/87zj2sh1wt@mid.deneb.enyo.de

Re: The Spirit of Free Software, or The Reality

* Bas Wijnen:

 I have some experience with safe browsing, but indeed I have not
 looked up how it works.  I do know that it continuously sends data
 to Google, and I have quite a bit of confidence in their capability
 and willingness to use that data for tracking.  From your
 description it sounds like that is not trivial, but there are smart
 people at Google, and they have near infinite resources.

One aspect that could be fixed fairly easily: Iceweasel sends your
Google cookies along those requests (and accepts new Google cookies if
you do not have them).  That's not really required by the protocol.

Similarly for OCSP requests: There should be no need at all to accept
or send cookies on them.


-- 
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: https://lists.debian.org/87twt0h1sw@mid.deneb.enyo.de

Re: The Spirit of Free Software, or The Reality

* Nikolaus Rath:

 On Jul 15 2015, Bas Wijnen wij...@debian.org wrote:
 As Jakub was saying: just starting it up without even visiting a site yet 
 will
 do a POST and a *few dozen* GET requests.  Shouldn't it be waiting with its
 checks until it actually knows what to check?  What is it sending them at
 browser startup?

 Why don't you check the code?

I found the Mozilla safe-browsing code *very* hard to read.  It's not
just the protocol, you also need to know a lot about how Javascript is
used as part of the browser implementation.


-- 
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: https://lists.debian.org/87pp3oh1qs@mid.deneb.enyo.de

Re: Replacement Default Icons for Iceweasel [was Re: The Spirit of Free Software, or The Reality]

* Don Armstrong:

 On Thu, 16 Jul 2015, Don Armstrong wrote:
 This is why I said if they're necessary, then they're necessary.

 Here's a set of default icons which can trivially be expanded to avoid
 shipping those icons and downloading them: 

 for icon in ebay google wikipedia bing; do 
 convert -size 16x16 xc:white -pointsize 8 \
 -font 'DejaVu-Sans' -fill black \
 -stroke none \
 -draw text 0,7 '${icon:0:3}' \
 -draw text 0,14 '${icon:3:3}' \
 ${icon}.png;
 done;

Thanks, I think that's an acceptable interim solution until we can
obtain permission to ship the actual logos under terms we like.


-- 
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: https://lists.debian.org/87zj2sfku5@mid.deneb.enyo.de

Re: Replacement Default Icons for Iceweasel [was Re: The Spirit of Free Software, or The Reality]

2015-07-19 Thread Marco d'Itri

On Jul 19, Florian Weimer f...@deneb.enyo.de wrote:

 Thanks, I think that's an acceptable interim solution until we can
 obtain permission to ship the actual logos under terms we like.
I think it's a crappy solution that makes Debian worse and solves no 
problem except DFSG-fetishism.

-- 
ciao,
Marco


pgpuJ9qXp85rv.pgp
Description: PGP signature

Re: The Spirit of Free Software, or The Reality

2015-07-19 Thread Philipp Kern

On Sat, Jul 18, 2015 at 01:20:19PM +0200, Ole Streicher wrote:
  The use of non-free icons if IMO a perfect use case for non-free.
  ... and also yet another case when to make their life comfortable one
  should enable non-free.
[...]
 The main idea of non-free is to have such a pragmatic approach here.
 
 And the put the non-free logos into non-free solution would fit into
 the do-it-yourself pragmatic of Debian: If you feel that there should be
 a free alternative, just create one. When an alternative icon is good
 enough that people will switch, then non-free is not needed anymore. Or
 convince the copyright owner to make the logos free. I see no real point
 in a heated discussion then.

Some trademark owners might be very annoyed if their name appears next
to an icon that does not belong to their brand. I agree that what you
describe would normally be the course of action how it should go: the
proprietary (but distributable) way first in non-free and a free
alternative in main (c.f. unrar and unar) once it's available.

That being said it does not apply to everything. This is a hard case
(unless we do not advertise search engines at all) and what Andrey meant
(firmware) is also a hard case. It is possible that free firmware
appears but it is also very unlikely and in the meantime it's unusable.
Plus suddenly everyone has to enable non-free by default.

You might call your proposition pragmatic, but the more pragmatic
choice would be to keep the icons in main.

Kind regards
Philipp Kern, who still ponders if we should move firmware into a
distinct component


signature.asc
Description: Digital signature

Re: The Spirit of Free Software, or The Reality

2015-07-19 Thread Ole Streicher

Philipp Kern pk...@debian.org writes:
 On Sat, Jul 18, 2015 at 01:20:19PM +0200, Ole Streicher wrote:
  The use of non-free icons if IMO a perfect use case for non-free.
  ... and also yet another case when to make their life comfortable one
  should enable non-free.
 [...]
 The main idea of non-free is to have such a pragmatic approach here.
 
 And the put the non-free logos into non-free solution would fit into
 the do-it-yourself pragmatic of Debian: If you feel that there should be
 a free alternative, just create one. When an alternative icon is good
 enough that people will switch, then non-free is not needed anymore. Or
 convince the copyright owner to make the logos free. I see no real point
 in a heated discussion then.

 Some trademark owners might be very annoyed if their name appears next
 to an icon that does not belong to their brand.

So this would give us some pressure to the owner to make their trademark
DFSG compatible?

 You might call your proposition pragmatic, but the more pragmatic
 choice would be to keep the icons in main.

If someone wants to have a DFSG compatible system, then he should be
able to get it -- which means that he should be allowed to change
whatever he wants (and to publish it). Then he does not get the original
icons.

This who can live with icons that are not legally editable can just
enable non-free and use the icons. I don't see any complication here.

Keeping the icons in main means the we revoke the choice whether to have
a free system. I personally always just switch on non-free + contrib,
but I respect those who don't.

Best regards

Ole



-- 
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: https://lists.debian.org/87a8usxpzw@news.ole.ath.cx

Re: The Spirit of Free Software, or The Reality

2015-07-19 Thread Balasankar C

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA512

On ഞായര്‍ 19 ജൂലൈ 2015 06:06 വൈകു, Philipp Kern wrote:
 Some trademark owners might be very annoyed if their name appears
 next to an icon that does not belong to their brand.

Shouldn't this situation be used as a chance to convince the logo
owners to make them free? Properly let them know that we'll have to
use different logos unless he/she makes theirs free and If he/she
doesn't cooperate, we are left with no other option, but to change
them. Just a suggestion (probably a silly one).

- -- 
Regards
Balasankar C
http://balasankarc.in
-BEGIN PGP SIGNATURE-
Version: GnuPG v2

iQEcBAEBCgAGBQJVq6mOAAoJEJbtq5sua3FxLFMH/RqEI5TWZPdQK8FOEyWqyioj
hMGfkAvQ03UgoVzut32JytYCXzokuG5n+WN+xDwZYFRdtc4BRn8LXI5emU0mkmB1
El+sa7wS1m+VZuVP4WQeqYXuV5kgrPwBlkKLtGKZEwDYJeBfm5wrJ8qQj4f6La5t
bUSpnOy27FhpnM5E/C52KMdvfgOiuH60yRssL8qjCfY8k9MxsUicYULjTvELFBgz
36t8KhJkMCTQDr7gLgJ88annwwrHNw9H2bexAjGh2JvVPh1x3R+Lh0enwhlZL2Dz
u0aI6eXLyR6Hs42MnOgKQjqxMRrQJxThBMOQh+KlztllrFg0FfPkoYxzG1k1HnA=
=gIus
-END PGP SIGNATURE-


0x2E6B7171.asc
Description: application/pgp-keys

Re: The Spirit of Free Software, or The Reality

2015-07-19 Thread Mike Hommey

On Sun, Jul 19, 2015 at 12:36:15PM +0200, Florian Weimer wrote:
 * Bas Wijnen:
 
  I have some experience with safe browsing, but indeed I have not
  looked up how it works.  I do know that it continuously sends data
  to Google, and I have quite a bit of confidence in their capability
  and willingness to use that data for tracking.  From your
  description it sounds like that is not trivial, but there are smart
  people at Google, and they have near infinite resources.
 
 One aspect that could be fixed fairly easily: Iceweasel sends your
 Google cookies along those requests (and accepts new Google cookies if
 you do not have them).  That's not really required by the protocol.

No, it doesn't since version 27.
https://bugzilla.mozilla.org/show_bug.cgi?id=897516

Mike


-- 
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: https://lists.debian.org/20150719222149.ga10...@glandium.org

Re: The Spirit of Free Software, or The Reality

2015-07-19 Thread Philipp Kern

On Sun, Jul 19, 2015 at 02:59:15PM +0200, Ole Streicher wrote:
 If someone wants to have a DFSG compatible system, then he should be
 able to get it -- which means that he should be allowed to change
 whatever he wants (and to publish it). Then he does not get the original
 icons.
 
 This who can live with icons that are not legally editable can just
 enable non-free and use the icons. I don't see any complication here.

But the copyright license doesn't matter much for this, unless it
contains a trademark grant. Which isn't what we historically required.
The reason we avoid the Firefox image for Mozilla's Firefox is their
trademark policy, not its copyright license.

So I'm hard pressed to see a case where you'd be able to freely create
derived works of trademarked icons even if the copyright license were
to be fixed.

And there are a lot more trademarks in Debian. Similarly you are not
allowed to modify Debian and distribute it as Debian. Hence the case
of trademarked icons seems to be fairly distinct from the usual
modification clauses we want. Required icon changes and renames are
similar.

Kind regards
Philipp Kern


--
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: https://lists.debian.org/20150719172716.ga29...@home.philkern.de

Re: The Spirit of Free Software, or The Reality

2015-07-19 Thread Ole Streicher

Philipp Kern pk...@debian.org writes:
 But the copyright license doesn't matter much for this, unless it
 contains a trademark grant. Which isn't what we historically required.
 The reason we avoid the Firefox image for Mozilla's Firefox is their
 trademark policy, not its copyright license.

 So I'm hard pressed to see a case where you'd be able to freely create
 derived works of trademarked icons even if the copyright license were
 to be fixed.

 And there are a lot more trademarks in Debian. Similarly you are not
 allowed to modify Debian and distribute it as Debian. Hence the case
 of trademarked icons seems to be fairly distinct from the usual
 modification clauses we want. Required icon changes and renames are
 similar.

OK, that convinces me.

Best regards

Ole


-- 
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: https://lists.debian.org/87615gxcj2@news.ole.ath.cx

Re: The Spirit of Free Software, or The Reality

2015-07-19 Thread Alexander Cherepanov


[Resending to the list, sorry.]

On 2015-07-17 16:03, Thorsten Glaser wrote:

Ian Jackson ijackson at chiark.greenend.org.uk writes:


The problem is simply that the icons are non-DFSG-free.


You could make a screenshot from where the original icons are shown,
then re-encode those tiny 16x16px thingies into new *.ico files with
GIMP. This is sorta like taking a photograph (if in doubt, take an
actual photo),


I guess taking a photograph doesn't change a copyright status of a thing 
in most jurisdictions (or make things even more complex if there is 
creativity in the photo itself etc.)



or a bitmap font (where neither the font nor the indi‐
vidual glyphs fall under copyright law),


Fonts are special in that their creative form serves a functional role 
at the same time. Hence they are frequently protected by patents or some 
such. In practice, the copyright situation in US for bitmap fonts is 
mostly clear but for non-bitmap fonts it is kinda surreal.



so only trademark law matters,
and Don already said Debian can “probably” use them to refer to the
sites in question.


--
Alexander Cherepanov


--
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: https://lists.debian.org/55abf2f0.7010...@openwall.com

Re: The Spirit of Free Software, or The Reality

2015-07-18 Thread Ole Streicher

Ben Finney ben+deb...@benfinney.id.au writes:
 Distributing them to Debian recipients makes the implicit promise that
 they are free by the DFSG, or that they should be removed from Debian if
 that's discovered to be untrue.

Can't we just put non-free logos to non-free? In main they could be
replaced by either a simple png with the name in it (someone provided an
example how to create them) or by something created by a designer from
scratch.

The use of non-free icons if IMO a perfect use case for non-free.

Best regards

Ole


-- 
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: https://lists.debian.org/87egk5vodq@debian.org

Re: The Spirit of Free Software, or The Reality

2015-07-18 Thread Mike Hommey

On Sat, Jul 18, 2015 at 01:09:37PM +0800, Paul Wise wrote:
 On Sat, Jul 18, 2015 at 6:26 AM, Mike Hommey wrote:
 
  Screenshots of games during play are not the same as logos.
 
 Are you saying that screenshots of logos aren't derivative works of those 
 logos?

I'm saying you can't derive any knowledge from that debian-legal post
about screenshot of games.

Mike


-- 
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: https://lists.debian.org/20150718092346.ga11...@glandium.org

Re: The Spirit of Free Software, or The Reality

2015-07-18 Thread Andrey Rahmatullin

On Sat, Jul 18, 2015 at 10:52:33AM +0200, Ole Streicher wrote:
  Distributing them to Debian recipients makes the implicit promise that
  they are free by the DFSG, or that they should be removed from Debian if
  that's discovered to be untrue.
 
 Can't we just put non-free logos to non-free? In main they could be
 replaced by either a simple png with the name in it (someone provided an
 example how to create them) or by something created by a designer from
 scratch.
 
 The use of non-free icons if IMO a perfect use case for non-free.
... and also yet another case when to make their life comfortable one
should enable non-free.

-- 
WBR, wRAR


signature.asc
Description: Digital signature

Re: The Spirit of Free Software, or The Reality

2015-07-18 Thread Ole Streicher

Andrey Rahmatullin w...@debian.org writes:
 On Sat, Jul 18, 2015 at 10:52:33AM +0200, Ole Streicher wrote:
  Distributing them to Debian recipients makes the implicit promise that
  they are free by the DFSG, or that they should be removed from Debian if
  that's discovered to be untrue.
 
 Can't we just put non-free logos to non-free? In main they could be
 replaced by either a simple png with the name in it (someone provided an
 example how to create them) or by something created by a designer from
 scratch.
 
 The use of non-free icons if IMO a perfect use case for non-free.
 ... and also yet another case when to make their life comfortable one
 should enable non-free.

For the logos in non-free, I feel that the discussion a bit academic: I
don't see why our freedom is factically limited by not being allowed to
patch the logos. We are still allowed to create new ones if we feel that
they don't fit. The main idea of non-free is to have such a pragmatic
approach here.

And the put the non-free logos into non-free solution would fit into
the do-it-yourself pragmatic of Debian: If you feel that there should be
a free alternative, just create one. When an alternative icon is good
enough that people will switch, then non-free is not needed anymore. Or
convince the copyright owner to make the logos free. I see no real point
in a heated discussion then.

Cheers

Ole



-- 
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: https://lists.debian.org/87615hvhjg@debian.org

Replacement Default Icons for Iceweasel [was Re: The Spirit of Free Software, or The Reality]

2015-07-17 Thread Don Armstrong

On Thu, 16 Jul 2015, Don Armstrong wrote:
 This is why I said if they're necessary, then they're necessary.

Here's a set of default icons which can trivially be expanded to avoid
shipping those icons and downloading them: 

for icon in ebay google wikipedia bing; do 
convert -size 16x16 xc:white -pointsize 8 \
-font 'DejaVu-Sans' -fill black \
-stroke none \
-draw text 0,7 '${icon:0:3}' \
-draw text 0,14 '${icon:3:3}' \
${icon}.png;
done;

-- 
Don Armstrong  http://www.donarmstrong.com

Judge if you want.
We are all going to die.
I intend to deserve it.
 -- a softer world #421
http://www.asofterworld.com/index.php?id=421


-- 
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: https://lists.debian.org/20150717143800.GR6137@geta

Re: The Spirit of Free Software, or The Reality

2015-07-17 Thread Adrien CLERC

Le 17/07/2015 12:57, Mike Hommey a écrit :
 On Fri, Jul 17, 2015 at 02:38:12PM +0800, Paul Wise wrote:
 On Thu, Jul 16, 2015 at 6:17 AM, Mike Hommey wrote:

 I, myself, find our DFSG-freeness pickiness going too far, and I'm sick
 of this icon thing. So, here's what I'm going to do: unless I hear
 non-IANAL objection until the next upstream release due on august 11
 (and I'm BCCing the DPL in case he wants to have the SPI lawyer(s) look
 into this), I will remove the replacement of the bundled icons with
 urls.
 How about just disabling the icons altogether? They seem unnessecary
 to me. Removing them would avoid both the potential DFSG issue and the
 privacy issue.
 Would you dare say this is useful?
 http://i.imgur.com/duKHZKF.png

 Mike


This seems to be the new DFSG game. Pick an icon, and get random results.

Adrien


-- 
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: https://lists.debian.org/55a8ef44.7000...@antipoul.fr

Re: The Spirit of Free Software, or The Reality

Ian Jackson ijackson at chiark.greenend.org.uk writes:

For example, in this case, it would be technically possible for
(say) Google (or someone masquerading as Google) to change the icon
offered to Debian's Iceweasel to one which looks very like
Wikipedia's icon.

FWIW, there are DuckDuckGo iceweasel search plugins out there
(don’t know if the one Debian ships is one of them) that encode
the favicon, which makes it not download it:

Image width=16 height=16data:image/x-icon;base64,AAABAAEAEBEAIAB[…]

Maybe patch all the others to do that could help?

bye,
//mirabilos, who agrees those implicit requests are not so nice

Re: The Spirit of Free Software, or The Reality

2015-07-17 Thread Zlatan Todoric

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256



On 07/17/2015 12:57 PM, Mike Hommey wrote:
 On Fri, Jul 17, 2015 at 02:38:12PM +0800, Paul Wise wrote:
 On Thu, Jul 16, 2015 at 6:17 AM, Mike Hommey wrote:
 
 I, myself, find our DFSG-freeness pickiness going too far, and
 I'm sick of this icon thing. So, here's what I'm going to do:
 unless I hear non-IANAL objection until the next upstream
 release due on august 11 (and I'm BCCing the DPL in case he
 wants to have the SPI lawyer(s) look into this), I will remove
 the replacement of the bundled icons with urls.
 
 How about just disabling the icons altogether? They seem
 unnessecary to me. Removing them would avoid both the potential
 DFSG issue and the privacy issue.
 
 Would you dare say this is useful? http://i.imgur.com/duKHZKF.png

One Search Icon To Rule Them All!

- -- 
It's not the COST, it's the VALUE
-BEGIN PGP SIGNATURE-
Version: GnuPG v2

iQIcBAEBCAAGBQJVqPK3AAoJEC5cILs3kzv9FZ4P/3sCfcydSXC3gcCTD6Xw/mZo
YEAimquwDDXUcKuliOTL8XbBRG5xFX34eLqefpbs99x0qK0tbzF2vwFds3Gk1PF9
IwkeSaxp7JWRbNv0gCMEUTQ2QnYqTgmSCjy3YdCFVOTp0K+pfTy9uqUvWgfbF0Mq
uxYrymRuGnFCFhTSzRe1dLnSsq6X3rIVhWiwt9np22O+sLCfa19krBc7ZTBIYTfo
E9AiEx7lz+JZxE+jZ1CyG/GBhuYz5USkNNmr9FX6nKkFK98/2wZ0HDvHKPhLD75a
ZJeiSG1caQQ0o/6yQsI0O5HAxEVwEPeSCmwBMD2jn7Nm8KRKMdxyt5qpSpyE06iR
qkd8if0SnMKq5BgNORvZBkXIoWETHo4yOS2QUSy4U2xY5GhW2WqeFG4BJaHcrvQd
O0XqANn8jItuFQF0DI/V2oHiwsQLscaocNlXcpygF3HPxSES6jak94uoJRvIziCx
u4kc+wv3TvLBSek0h+felF/40aXbKAU1SzIp7qJFWJRXMiBiDj2zo8iKxcRmy0Oa
XU57icZ9k+p3YibJyqlAi7BAGDsc5YQPZa7Rrqdb/Rl5S7/Qv3py+4o2TJpPD3qY
nULrGLlQIrrOHsDgRbSvAiEx6D07d66YaQApNcjRuA7HFydpZhs1baGttApRMTE1
1kjTIqjUJe9DFJBnq6yM
=efXC
-END PGP SIGNATURE-


-- 
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: https://lists.debian.org/55a8f2b8.6020...@riseup.net

Re: The Spirit of Free Software, or The Reality

2015-07-17 Thread Adrien CLERC

Le 17/07/2015 15:09, Thorsten Glaser a écrit :
 OK, wrong place to complain about RequestPolicy, admittedly.
 It’s just that it’s the only actually effective ad blocker,
 for use by me when lynx, my default webbrowser, isn’t enough.


Maybe you should try the I am an advanced user of uBlock (or uBlock
Origin, it's up to you). It replaces AdblockPlus and RequestPolicy in a
much more efficient UI for me. More complex also…

Adrien


-- 
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: https://lists.debian.org/55a90c84.40...@antipoul.fr

Re: The Spirit of Free Software, or The Reality

On Fri, 17 Jul 2015, Adrien CLERC wrote:

 Maybe you should try the I am an advanced user of uBlock (or uBlock
 Origin, it's up to you). It replaces AdblockPlus and RequestPolicy in a
 much more efficient UI for me. More complex also…

Hm, but, tbh, I’m not. I absolutely hate Firef*x but there are
certain “web applications” that require it. Also, things like
geographic applications (geocaching, geodashing, geovexilla,
geohashing, shutterspot, munzee, …) don’t make sense in lynx.
I still try to use it as few as possible.

bye,
//mirabilos
-- 
Sometimes they [people] care too much: pretty printers [and syntax highligh-
ting, d.A.] mechanically produce pretty output that accentuates irrelevant
detail in the program, which is as sensible as putting all the prepositions
in English text in bold font.   -- Rob Pike in Notes on Programming in C


--
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: 
https://lists.debian.org/alpine.deb.2.20.1507171615240.11...@tglase.lan.tarent.de

Re: The Spirit of Free Software, or The Reality

Ian Jackson ijackson at chiark.greenend.org.uk writes:

 The problem is simply that the icons are non-DFSG-free.

You could make a screenshot from where the original icons are shown,
then re-encode those tiny 16x16px thingies into new *.ico files with
GIMP. This is sorta like taking a photograph (if in doubt, take an
actual photo), or a bitmap font (where neither the font nor the indi‐
vidual glyphs fall under copyright law), so only trademark law matters,
and Don already said Debian can “probably” use them to refer to the
sites in question.

I question that 16x16px logos fall under the copyright law at all.
Maybe some of the picture metadata, at best (hence the suggestion
to re-encode).

Re: The Spirit of Free Software, or The Reality

Adam Borowski kilobyte at angband.pl writes:

 Note that while requestpolicycontinued is capable to do everything original
 requestpolicy did, in its default mode it's just a poor ad blocker, 

The new xul-ext-requestpolicy is a severe regression from the old one:

• it defaults to all permitted
• it fails at importing old permissions
• if you temporarily enable all requests, then exit iceweasel and start
  it anew, it is still in the “temporarily enable all requests” mode

Furthermore – but the old one couldn’t do this either – there’s no way
to say “always forbid to this specific site and don’t bother me with
it again (e.g. by using the red flag”. The new one can add “always forbid”
rules, but it fails in that…
• … the red flag is still shown
• … it blocks same-site requests (e.g. twitter.com → twitter.com, if
  requests to twitter.com are blocked), which wouldn’t be so bad if not for…
• … it doesn’t have a way to grant explicit exceptions for such blocks

OK, wrong place to complain about RequestPolicy, admittedly.
It’s just that it’s the only actually effective ad blocker,
for use by me when lynx, my default webbrowser, isn’t enough.

bye,
//mirabilos

Re: The Spirit of Free Software, or The Reality

On Thu, Jul 16, 2015 at 6:17 AM, Mike Hommey wrote:

 I, myself, find our DFSG-freeness pickiness going too far, and I'm sick
 of this icon thing. So, here's what I'm going to do: unless I hear
 non-IANAL objection until the next upstream release due on august 11
 (and I'm BCCing the DPL in case he wants to have the SPI lawyer(s) look
 into this), I will remove the replacement of the bundled icons with
 urls.

How about just disabling the icons altogether? They seem unnessecary
to me. Removing them would avoid both the potential DFSG issue and the
privacy issue.

-- 
bye,
pabs

https://wiki.debian.org/PaulWise


-- 
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: 
https://lists.debian.org/caktje6hyombuyrhdixzwuqo22rsqkywette3mjjvm2gq7a4...@mail.gmail.com

Re: The Spirit of Free Software, or The Reality

On Thu, Jul 16, 2015 at 7:53 PM, Ian Jackson wrote:

 I have also made the point that we make an exception for licence
 texts.  Obviously the situations aren't entirely parallel, but this
 demonstrates that the absolutist position you are arguing for is both
 contrary to our existing practice, and impractical.  If you are saying
 that this principle of modifiability is entirely absolute and we have
 to make no exceptions at all at all at all, you have to address that
 point too.

Without these non-modifiable license texts there would be basically no
Debian at all as the license texts are what makes the rest of a
package containing them DFSG-free. So basically this exception is one
we don't have a real choice in. This isn't the case for icons, which
are could be removed or disabled without anywhere near as much effect.

-- 
bye,
pabs

https://wiki.debian.org/PaulWise


-- 
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: 
https://lists.debian.org/caktje6hfgxvgfsbwwa0xulog6+khlkyz8ajjebfhgzoq1w-...@mail.gmail.com

Re: The Spirit of Free Software, or The Reality

2015-07-17 Thread Moritz Mühlenhoff

Paul Wise p...@debian.org schrieb:
 On Thu, Jul 16, 2015 at 6:17 AM, Mike Hommey wrote:

 I, myself, find our DFSG-freeness pickiness going too far, and I'm sick
 of this icon thing. So, here's what I'm going to do: unless I hear
 non-IANAL objection until the next upstream release due on august 11
 (and I'm BCCing the DPL in case he wants to have the SPI lawyer(s) look
 into this), I will remove the replacement of the bundled icons with
 urls.

Fully agreed.

 How about just disabling the icons altogether? They seem unnessecary
 to me.

They're certainly necessary. W/o the icons there would be no indication
which search engine is currently selected in the Iceweasel search box.

Cheers,
Moritz


-- 
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: https://lists.debian.org/slrnmqhae5.iss@inutil.org

Re: The Spirit of Free Software, or The Reality

On Fri, 2015-07-17 at 19:57 +0900, Mike Hommey wrote:

 Would you dare say this is useful?
 http://i.imgur.com/duKHZKF.png

I agree that isn't very useful. I don't actually use the search bar as
you can't[1] have multiple instances of it so I hadn't seen current
versions of it but I did see that an earlier version of Firefox used a
simple drop-down of names and icons. That would work just fine with the
icons removed from the drop-down.

1. 
http://bonedaddy.net/pabs3/log/2011/11/04/migrate-from-galeon-to-iceweasel-firefox/

-- 
bye,
pabs

https://wiki.debian.org/PaulWise



signature.asc
Description: This is a digitally signed message part

Re: The Spirit of Free Software, or The Reality

2015-07-17 Thread Mike Hommey

On Fri, Jul 17, 2015 at 02:38:12PM +0800, Paul Wise wrote:
 On Thu, Jul 16, 2015 at 6:17 AM, Mike Hommey wrote:
 
  I, myself, find our DFSG-freeness pickiness going too far, and I'm sick
  of this icon thing. So, here's what I'm going to do: unless I hear
  non-IANAL objection until the next upstream release due on august 11
  (and I'm BCCing the DPL in case he wants to have the SPI lawyer(s) look
  into this), I will remove the replacement of the bundled icons with
  urls.
 
 How about just disabling the icons altogether? They seem unnessecary
 to me. Removing them would avoid both the potential DFSG issue and the
 privacy issue.

Would you dare say this is useful?
http://i.imgur.com/duKHZKF.png

Mike


-- 
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: https://lists.debian.org/20150717105745.ga31...@glandium.org

Re: The Spirit of Free Software, or The Reality

On Fri, Jul 17, 2015 at 3:07 PM, Moritz Mühlenhoff wrote:

 They're certainly necessary. W/o the icons there would be no indication
 which search engine is currently selected in the Iceweasel search box.

The Tor Browser has the name of the search engine in the search box in
grey when no text has been typed. That should be enough of an
indicator.

-- 
bye,
pabs

https://wiki.debian.org/PaulWise


--
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: 
https://lists.debian.org/caktje6fr0mkpb5u0c-hv0dudswcwjordv5vfdsspt9oualo...@mail.gmail.com

Re: The Spirit of Free Software, or The Reality

On Fri, Jul 17, 2015 at 9:03 PM, Thorsten Glaser wrote:

 You could make a screenshot from where the original icons are shown,
 then re-encode those tiny 16x16px thingies into new *.ico files with
 GIMP. This is sorta like taking a photograph (if in doubt, take an
 actual photo), or a bitmap font (where neither the font nor the indi‐
 vidual glyphs fall under copyright law), so only trademark law matters,
 and Don already said Debian can “probably” use them to refer to the
 sites in question.

Debian has legal advice from SPI lawyers that screenshots are
derivative works and thus are under the same license as the software
they are derived from.

http://lists.debian.org/debian-legal/2008/08/msg00016.html
http://lists.debian.org/debian-legal/2008/08/msg00018.html

Trademarks are indeed irrelevant here.

 I question that 16x16px logos fall under the copyright law at all.
 Maybe some of the picture metadata, at best (hence the suggestion
 to re-encode).

I expect some creativity goes into cramming logos into such a small
space but IANAL so...

-- 
bye,
pabs

https://wiki.debian.org/PaulWise


--
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: 
https://lists.debian.org/caktje6g0xe0qv5immdjnfxz6sx6-tv7qbf6jva1lukx_772...@mail.gmail.com

Re: The Spirit of Free Software, or The Reality

2015-07-17 Thread Octavio Alvarez


On 07/16/2015 01:00 AM, Ben Finney wrote:

Bas Wijnen wij...@debian.org writes:


The problem that nobody mentioned it may be caused by the fact that
nobody really considers those icons non-free,


The copyright holder of those icons does not, AFAIK, grant restricted
license for recipients to modify and redistribute the work.

That makes those works non-free by my reading of the Social Contract.


IANAL but the icons are not part of the work (the browser); they are 
trademarks for purposes of identification of an integration with a 
third-party service; they don't have to be DFSG-free, just 
redistributable by Debian (and possibly not even that because this usage 
could fall into fair use, as long as there is no claim or appearance 
that the third-party endorses the work).


Best regards.


--
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: https://lists.debian.org/55a9239b.3060...@alvarezp.org

Re: The Spirit of Free Software, or The Reality

2015-07-17 Thread Nikolaus Rath

On Jul 17 2015, Mike Hommey m...@glandium.org wrote:
 On Fri, Jul 17, 2015 at 02:38:12PM +0800, Paul Wise wrote:
 On Thu, Jul 16, 2015 at 6:17 AM, Mike Hommey wrote:
 
  I, myself, find our DFSG-freeness pickiness going too far, and I'm sick
  of this icon thing. So, here's what I'm going to do: unless I hear
  non-IANAL objection until the next upstream release due on august 11
  (and I'm BCCing the DPL in case he wants to have the SPI lawyer(s) look
  into this), I will remove the replacement of the bundled icons with
  urls.
 
 How about just disabling the icons altogether? They seem unnessecary
 to me. Removing them would avoid both the potential DFSG issue and the
 privacy issue.

 Would you dare say this is useful?
 http://i.imgur.com/duKHZKF.png

Mike, thank you for continuing to put up with this (and for actually
bothering to reply with a screenshot).


Best,
-Nikolaus

-- 
GPG encrypted emails preferred. Key id: 0xD113FCAC3C4E599F
Fingerprint: ED31 791B 2C5C 1613 AF38 8B8A D113 FCAC 3C4E 599F

 »Time flies like an arrow, fruit flies like a Banana.«


--
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: https://lists.debian.org/87io9ikbi4@thinkpad.rath.org

Re: The Spirit of Free Software, or The Reality

2015-07-17 Thread Chris Bannister

On Wed, Jul 15, 2015 at 08:00:52AM -0700, Nikolaus Rath wrote:
 On Jul 15 2015, Bas Wijnen wij...@debian.org wrote:
  As Jakub was saying: just starting it up without even visiting a site yet 
  will
  do a POST and a *few dozen* GET requests.  Shouldn't it be waiting with its
  checks until it actually knows what to check?  What is it sending them at
  browser startup?
 
 Why don't you check the code?

That won't answer the why, just the how.

-- 
If you're not careful, the newspapers will have you hating the people
who are being oppressed, and loving the people who are doing the 
oppressing. --- Malcolm X


-- 
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: https://lists.debian.org/20150717174016.GB22734@tal

Re: The Spirit of Free Software, or The Reality

2015-07-17 Thread Philip Hands

Paul Wise p...@debian.org writes:

 On Fri, Jul 17, 2015 at 3:07 PM, Moritz Mühlenhoff wrote:

 They're certainly necessary. W/o the icons there would be no indication
 which search engine is currently selected in the Iceweasel search box.

 The Tor Browser has the name of the search engine in the search box in
 grey when no text has been typed. That should be enough of an
 indicator.

Have you considered that by removing the logos there are almost
certainly people who will be less able to recognise which search engine
they have selected?  (be that because of poor sight, poor reading
ability or perhaps because they only know the thing they want by its logo)

Even if we had the right under copyright law to modify these logos, we'd
not want to do it, because we're trying to display a trademark image in
order to refer to the related service.

It strikes me that the names of at least some of these services are also
trademarked, so the text is presumably also immutable to some extent.

Cheers, Phil.
-- 
|)|  Philip Hands  [+44 (0)20 8530 9560]  HANDS.COM Ltd.
|-|  http://www.hands.com/http://ftp.uk.debian.org/
|(|  Hugo-Klemm-Strasse 34,   21075 Hamburg,GERMANY


signature.asc
Description: PGP signature

Re: The Spirit of Free Software, or The Reality

2015-07-17 Thread Nikolaus Rath

On Jul 18 2015, Chris Bannister cbannis...@slingshot.co.nz wrote:
 On Wed, Jul 15, 2015 at 08:00:52AM -0700, Nikolaus Rath wrote:
 On Jul 15 2015, Bas Wijnen wij...@debian.org wrote:
  As Jakub was saying: just starting it up without even visiting a site yet 
  will
  do a POST and a *few dozen* GET requests.  Shouldn't it be waiting with its
  checks until it actually knows what to check?  What is it sending them at
  browser startup?
 
 Why don't you check the code?

 That won't answer the why, just the how.

Aeh, please re-read what you've quoted. The question was *what*, not
*why* or *how*. And the code will answer that exactly.

Best,
-Nikolaus

-- 
GPG encrypted emails preferred. Key id: 0xD113FCAC3C4E599F
Fingerprint: ED31 791B 2C5C 1613 AF38 8B8A D113 FCAC 3C4E 599F

 »Time flies like an arrow, fruit flies like a Banana.«


--
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: https://lists.debian.org/87si8mjx7j@thinkpad.rath.org

Re: The Spirit of Free Software, or The Reality

On Sat, Jul 18, 2015 at 6:26 AM, Mike Hommey wrote:

 Screenshots of games during play are not the same as logos.

Are you saying that screenshots of logos aren't derivative works of those logos?

-- 
bye,
pabs

https://wiki.debian.org/PaulWise


-- 
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: 
https://lists.debian.org/CAKTje6FCXNLoGbbQJV=qxezbhn+esqhsgquah3saufida67...@mail.gmail.com

Re: The Spirit of Free Software, or The Reality

On Sat, Jul 18, 2015 at 3:22 AM, Philip Hands wrote:

 Have you considered that by removing the logos there are almost
 certainly people who will be less able to recognise which search engine
 they have selected?  (be that because of poor sight, poor reading
 ability or perhaps because they only know the thing they want by its logo)

I hadn't considered that. I would assume that text is more accessible
as screen-readers can convert it to audio. I would assume that people
with poor sight are probably using magnification already. The latter
two seem reasonable.

 Even if we had the right under copyright law to modify these logos, we'd
 not want to do it, because we're trying to display a trademark image in
 order to refer to the related service.

 It strikes me that the names of at least some of these services are also
 trademarked, so the text is presumably also immutable to some extent.

Agreed.

-- 
bye,
pabs

https://wiki.debian.org/PaulWise


-- 
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: 
https://lists.debian.org/CAKTje6H1UQs-RTqEOam=r_thdxbeok6s3s6_oswwre91aiu...@mail.gmail.com

Re: The Spirit of Free Software, or The Reality

2015-07-17 Thread Mike Hommey

On Sat, Jul 18, 2015 at 12:57:41AM +0800, Paul Wise wrote:
 On Fri, Jul 17, 2015 at 9:03 PM, Thorsten Glaser wrote:
 
  You could make a screenshot from where the original icons are shown,
  then re-encode those tiny 16x16px thingies into new *.ico files with
  GIMP. This is sorta like taking a photograph (if in doubt, take an
  actual photo), or a bitmap font (where neither the font nor the indi‐
  vidual glyphs fall under copyright law), so only trademark law matters,
  and Don already said Debian can “probably” use them to refer to the
  sites in question.
 
 Debian has legal advice from SPI lawyers that screenshots are
 derivative works and thus are under the same license as the software
 they are derived from.
 
 http://lists.debian.org/debian-legal/2008/08/msg00016.html
 http://lists.debian.org/debian-legal/2008/08/msg00018.html
 
 Trademarks are indeed irrelevant here.

Screenshots of games during play are not the same as logos.

Mike


-- 
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: https://lists.debian.org/20150717222610.ga30...@glandium.org

Re: The Spirit of Free Software, or The Reality

2015-07-16 Thread Ben Finney

Bas Wijnen wij...@debian.org writes:

 The problem that nobody mentioned it may be caused by the fact that
 nobody really considers those icons non-free,

The copyright holder of those icons does not, AFAIK, grant restricted
license for recipients to modify and redistribute the work.

That makes those works non-free by my reading of the Social Contract.

 and so having them on our users' machines isn't a problem. But then I
 agree with Ian and Mike, we should just ship them in the package.

Distributing them to Debian recipients makes the implicit promise that
they are free by the DFSG, or that they should be removed from Debian if
that's discovered to be untrue.

So the above seems to argue either that search engine icons are
sufficiently important that we can violate the Social Contract, or I've
misunderstood. I'd like to know exactly where that misunderstanding is.

-- 
 \   “The surest way to corrupt a youth is to instruct him to hold |
  `\   in higher esteem those who think alike than those who think |
_o__) differently.” —Friedrich Nietzsche, _The Dawn_, 1881 |
Ben Finney


-- 
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: https://lists.debian.org/857fq0vdyv@benfinney.id.au

Re: The Spirit of Free Software, or The Reality

2015-07-16 Thread Marco d'Itri

On Jul 16, Mike Hommey m...@glandium.org wrote:

 I, myself, find our DFSG-freeness pickiness going too far, and I'm sick
 of this icon thing. So, here's what I'm going to do: unless I hear
 non-IANAL objection until the next upstream release due on august 11
 (and I'm BCCing the DPL in case he wants to have the SPI lawyer(s) look
 into this), I will remove the replacement of the bundled icons with
 urls.
Full support here...

-- 
ciao,
Marco


pgpWX23hiZSFE.pgp
Description: PGP signature

Re: The Spirit of Free Software, or The Reality

2015-07-16 Thread Ian Jackson

Ben Finney writes (Re: The Spirit of Free Software, or The Reality):
 So the above seems to argue either that search engine icons are
 sufficiently important that we can violate the Social Contract, or I've
 misunderstood. I'd like to know exactly where that misunderstanding is.

You are arguing from the Social Contract.  This is the Debian
equivalent of godwinating the conversation.  But I will try anyway.


The point of having ethical principles is to do good in the world.

We can disagree about what good is, of course.  But our users are not
harmed, and their freedom is not diminished, if we ship nonmodifable
icons for proprietary search services.[1]  There is no significant risk
that anyone would think that these icons are modifiable.

As I wrote before, in this case, pickiness about the modifiability of
the icons /is/ harming our users (not very much, but still).

You haven't come up with a counterargument to these points, which I
made in an earlier mail.


I have also made the point that we make an exception for licence
texts.  Obviously the situations aren't entirely parallel, but this
demonstrates that the absolutist position you are arguing for is both
contrary to our existing practice, and impractical.  If you are saying
that this principle of modifiability is entirely absolute and we have
to make no exceptions at all at all at all, you have to address that
point too.

If we are prepared to make exceptions, no matter how narrow, then
the question is: on what basis might we make an exception, and should
we make one in this case ?

I am happy that we should use our documented principles and aims to
guide our actions, but if applying the letter of the law undermines
our values, we should go with what is right rather than what is
written down.


One problem is that the principle that we should protect our users'
privacy isn't written down in our foundation documents, even though
it's clear that most of us (probably, an overwhelming majority) think
it important.  If it _were_ written down then it would be more obvious
that there is a conflict between different principles here.

As someone who has come to think that reference to foundation
documents to illuminate these kind of problems is not normally
helpful, I'm not particularly bothered that the foundation documents
lack a commitment to our users' privacy.

But if this bothers you then I would support a GR to improve this.  If
you are going to clean this up then you should probably also deal with
the fact that they also lack a commitment to our users' security, and
you should consider whether it would be useful for these documents to
use words and phrases like `autonomy' and `in practice'.


I'd like to thank Mike Hommey again for all his hard work and his
toleration for this kind of conversation.  I support his intentions as
he has just laid out.

Ian.


[1] To be clear, I mean that the users' freedoms are not diminished,
nor the users harmed, by the nonmodifiability of the icons.  An
argument could be made that the very presence of these search engine
configurations is a problem, but if that is the case it doesn't depend
very much on what icon is shown.  The obvious counterargument is that
respecting the user's autonomy - including not putting barriers in
front of their choice to use a proprietary service - is part of
upholding the user's freedom.


-- 
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: 
https://lists.debian.org/21927.39727.387280.432...@chiark.greenend.org.uk

Re: The Spirit of Free Software, or The Reality

2015-07-16 Thread Don Armstrong

On Thu, 16 Jul 2015, Mike Hommey wrote:
 On Wed, Jul 15, 2015 at 12:56:29PM +0100, Ian Jackson wrote:
  I was surprised that it would download the icons from the installed
  search providers. There is no need for it to do that. And that means
  that the mere presence of an unused but configured search provider,
  causes every user's iceweasel to notify the search provider whenever
  the user starts the browser.
 
 Starts the browser for the first time ever.

How easy would it be to modify the code so that it only gets the
favorite icons when the site is actually visited? [Does it already try
to update the icons when it visits one of the configured sites?]

Since I haven't read the code,[1] this might be too much work, but I was
thinking about shipping 1x1.png for those icons, and then having them be
updated if and when a user actually visits those sites.

-- 
Don Armstrong  http://www.donarmstrong.com

A Bill of Rights that means what the majority wants it to mean is worthless. 
 -- U.S. Supreme Court Justice Antonin Scalia


-- 
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: https://lists.debian.org/20150716145720.GI6137@geta

Re: The Spirit of Free Software, or The Reality

2015-07-16 Thread Neil McGovern

On Thu, Jul 16, 2015 at 07:17:03AM +0900, Mike Hommey wrote:
 I, myself, find our DFSG-freeness pickiness going too far, and I'm sick
 of this icon thing. So, here's what I'm going to do: unless I hear
 non-IANAL objection until the next upstream release due on august 11
 (and I'm BCCing the DPL in case he wants to have the SPI lawyer(s) look
 into this), I will remove the replacement of the bundled icons with
 urls.
 

In this case, I don't intend on doing so. If you (as the maintainer) or
the FTPMasters want me to, I'll forward it on, but I don't particularly
want to waste lawyers time on what seems to be a minor issue.

Neil
-- 


signature.asc
Description: Digital signature

Re: The Spirit of Free Software, or The Reality

2015-07-16 Thread Simon Richter

Hi,

Am 16.07.2015 um 16:57 schrieb Don Armstrong:

 How easy would it be to modify the code so that it only gets the
 favorite icons when the site is actually visited? [Does it already try
 to update the icons when it visits one of the configured sites?]

The problem is that the icons are displayed in the search field
dropdown, which should be fully functional before visiting the first site.

I believe that it is acceptable to ship these icons -- while they aren't
free to modify, there is no real reason why we would need that.

Trademark legislation should allow us to use these logos to refer to the
companies even without a formal permission, and would forbid us to use
them in any other context regardless of the copyright situation.

The only thing I'd see as problematic is when a company changes their
logo and wants us to stop distributing the old one -- this is something
we cannot do.

   Simon


-- 
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: https://lists.debian.org/55a7d511.4070...@debian.org

Re: The Spirit of Free Software, or The Reality

2015-07-16 Thread Bas Wijnen

Hi,

On Thu, Jul 16, 2015 at 06:00:17PM +0200, Simon Richter wrote:
 Am 16.07.2015 um 16:57 schrieb Don Armstrong:
  How easy would it be to modify the code so that it only gets the
  favorite icons when the site is actually visited? [Does it already try
  to update the icons when it visits one of the configured sites?]
 
 The problem is that the icons are displayed in the search field
 dropdown, which should be fully functional before visiting the first site.

Also, if it is acceptable to auto-download them, I don't see why it wouldn't be
acceptable to ship them.  It's one or the other: we want to protect our users
against this non-free material and don't give it to them, or we don't think it
is non-free (or that it is an acceptable exception, just like license texts)
and we do.  In the former case we don't ship and don't download; in the latter
case, we do ship and therefore still don't download.

 I believe that it is acceptable to ship these icons -- while they aren't
 free to modify, there is no real reason why we would need that.

I agree, and it seems Mike will start shipping them, which is good IMO.

Thanks,
Bas


-- 
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: https://lists.debian.org/20150716162105.gs8...@fmf.nl

Re: The Spirit of Free Software, or The Reality

2015-07-16 Thread Don Armstrong

On Thu, 16 Jul 2015, Simon Richter wrote:
 The problem is that the icons are displayed in the search field
 dropdown, which should be fully functional before visiting the first
 site.

I was hoping that it could be semi-functional, with placeholder icons
until the site in question is actually visited. But if the icons are
necessary, then they're necessary.

 I believe that it is acceptable to ship these icons -- while they
 aren't free to modify, there is no real reason why we would need that.

I think upstream is claiming that they're free to modify as far as
copyright is concerned, which is really all I'm personally concerned
about.

All of that said, I don't see a difference between us shipping the icons
and having the package automatically download them without the user
specifically visiting a site. [I'm speaking to the choir when I lament
the fact that so much leakage of information seems to be necessary in
order to use most modern devices... that ship has sailed, and we're just
fighting a rearguard action now.]

-- 
Don Armstrong  http://www.donarmstrong.com

There is no mechanical problem so difficult that it cannot be solved
by brute strength and ignorance.
 -- William's Law


-- 
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: https://lists.debian.org/20150716182933.GM6137@geta

Re: The Spirit of Free Software, or The Reality

2015-07-16 Thread IOhannes m zmölnig (Debian/GNU)

On 07/16/2015 08:29 PM, Don Armstrong wrote:
 On Thu, 16 Jul 2015, Simon Richter wrote:
  The problem is that the icons are displayed in the search field
  dropdown, which should be fully functional before visiting the first
  site.
 I was hoping that it could be semi-functional, with placeholder icons
 until the site in question is actually visited. But if the icons are
 necessary, then they're necessary.
 

what is the site in question you are referring to?

as in: the first time the user starts the browser, the search field will
be filled with empty (placeholder) icons. whenever they enter a search
term and select one of the unknown¹ search engines, the search is
performed (e.g. on wikipedia) and the placeholder icon is updated with
the real icon (since wikipedia was visited anyhow), and from know on the
user knows at least one of their search engines.
this feels a bit like
 Quaff the blue speckled potion.
 You have no more potions of blindness.

fmgsdr
IOhannes


¹ not totally unknown: there's a tooltip showing the name of the search
engine if you hover over it.



signature.asc
Description: OpenPGP digital signature

Re: The Spirit of Free Software, or The Reality

2015-07-16 Thread Riley Baird

On Thu, 16 Jul 2015 22:20:35 +0200
IOhannes m zmölnig (Debian/GNU) umlae...@debian.org wrote:

 On 07/16/2015 08:29 PM, Don Armstrong wrote:
  On Thu, 16 Jul 2015, Simon Richter wrote:
   The problem is that the icons are displayed in the search field
   dropdown, which should be fully functional before visiting the first
   site.
  I was hoping that it could be semi-functional, with placeholder icons
  until the site in question is actually visited. But if the icons are
  necessary, then they're necessary.
  
 
 what is the site in question you are referring to?
 
 as in: the first time the user starts the browser, the search field will
 be filled with empty (placeholder) icons. whenever they enter a search
 term and select one of the unknown¹ search engines, the search is
 performed (e.g. on wikipedia) and the placeholder icon is updated with
 the real icon (since wikipedia was visited anyhow), and from know on the
 user knows at least one of their search engines.
 this feels a bit like
  Quaff the blue speckled potion.
  You have no more potions of blindness.

What if the placeholder icons were the first letter of the search
engine's name?


pgpttdEVSZsSQ.pgp
Description: PGP signature

Re: The Spirit of Free Software, or The Reality

2015-07-16 Thread Don Armstrong

On Thu, 16 Jul 2015, IOhannes m zmölnig (Debian/GNU) wrote:
 On 07/16/2015 08:29 PM, Don Armstrong wrote:
  On Thu, 16 Jul 2015, Simon Richter wrote:
   The problem is that the icons are displayed in the search field
   dropdown, which should be fully functional before visiting the first
   site.
  I was hoping that it could be semi-functional, with placeholder icons
  until the site in question is actually visited. But if the icons are
  necessary, then they're necessary.
 
 what is the site in question you are referring to?

Whatever the icons correspond to.

 whenever they enter a search term and select one of the unknown¹
 search engines, the search is performed (e.g. on wikipedia) and the
 placeholder icon is updated with the real icon (since wikipedia was
 visited anyhow), and from know on the user knows at least one of their
 search engines.

This is why I said if they're necessary, then they're necessary; I use
iceweasel+pentadactyl, so I've no clue what the default search UI even
looks like any more. With pentadactyl, it helpfully tells you precisely
what the search engine is so you don't have to guess whose icon is a
briefcase.

-- 
Don Armstrong  http://www.donarmstrong.com

I'm wrong to criticize the valor of your brave men. It's important to
die for one's country when it means being the subject of a king who
wears a ruffled collar or a pleated one.
 -- Cyrano de Bergerac


-- 
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: https://lists.debian.org/20150716214849.GQ6137@geta

Re: The Spirit of Free Software, or The Reality

2015-07-15 Thread Bas Wijnen

On Wed, Jul 15, 2015 at 07:56:42PM +0100, Ian Jackson wrote:
 Right.  I find it disappointing to discover that in Debian we have
 deliberately modified Iceweasl to make this problem worse, even if
 only in a modest way.
... 
 And one thing we could easily do (well, easily from a technical point
 of view, if we could agree to do it) would be to not download the
 icons.  AIUI downloading the icons was a change that was made in
 Debian for DFSG reasons.

I've seen Mike's mail, and agree that his solution is appropriate.  I'd like to
note my opinion on what seems to have happened here though (it may not actually
be what happened, but this is a theoretical argument, so that is irrelevant):

We found that some content was not DFSG free, and therefore we didn't want to
distribute it in Debian.  I don't see how anyone could think that let the
program download the non-free material at first boot is an appropriate
solution for anything in main.  The point of software in main is that our users
trust that we don't put non-free stuff on their machine.  It really doesn't
matter if that stuff comes from the archive or is auto-downloaded from
somewhere else.

I don't expect this to be controversial, but I wanted to mention it anyway,
because nobody did so far, and if there is no consensus about this, I think we
should have a discussion about it.

The problem that nobody mentioned it may be caused by the fact that nobody
really considers those icons non-free, and so having them on our users'
machines isn't a problem.  But then I agree with Ian and Mike, we should just
ship them in the package.

Thanks,
Bas


-- 
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: https://lists.debian.org/20150716051023.gq8...@fmf.nl

Re: The Spirit of Free Software, or The Reality

2015-07-15 Thread Wouter Verhelst

On Wed, Jul 15, 2015 at 02:34:41PM +0900, Mike Hommey wrote:
 On Wed, Jul 15, 2015 at 01:09:47PM +0800, Paul Wise wrote:
  On Wed, Jul 15, 2015 at 12:26 PM, Mike Hommey wrote:
  
   FUD is easy. How about documenting yourself on how Safe browsing
   actually works? Hint: urls are _never_ sent to Google. The worst thing
   that Google can know is that the _hash_ of /some/ url you went to, has the
   first n bits matching the first n bits of the hash of one (or multiple)
   of the known malware of phishing urls. Nothing more.
  
  Why doesn't it just download the full list and do checks client-side?
 
 The full list is huge, so it downloads a smaller list with hash
 prefixes, then when it hits a match, it downloads a list of all the
 hashes that start with that prefix.

In other words, that's what it actually does, modulo some optimization
so it doesn't have to download terabytes of data.

-- 
It is easy to love a country that is famous for chocolate and beer

  -- Barack Obama, speaking in Brussels, Belgium, 2014-03-26


-- 
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: https://lists.debian.org/20150715074242.ga28...@grep.be

Re: The Spirit of Free Software, or The Reality

2015-07-15 Thread Riley Baird

  FWIW, those [requests to search engines to retrieve their icons] are a
  consequence of removing supposedly non-free icons from the source
  package. But maybe you'd prefer no icons at all for the list of search
  engines.
 
 That's a tough one. I haven't yet got a firm position on what should be
 done to resolve that.

A possible solution would be to make new icons. The problem with this
would be that they wouldn't be easily identifiable, which is the whole
point of icons.,,


pgpRwHWXpegEy.pgp
Description: PGP signature

Re: The Spirit of Free Software, or The Reality

Nikolaus Rath writes (Re: The Spirit of Free Software, or The Reality):
 On Jul 15 2015, Bas Wijnen wij...@debian.org wrote:
  As Jakub was saying: just starting it up without even visiting a
  site yet will do a POST and a *few dozen* GET requests.  Shouldn't
  it be waiting with its checks until it actually knows what to
  check?  What is it sending them at browser startup?
 
 Why don't you check the code?

I think asking questions is a reasonable way to go about this.  Having
been the maintainer of a similar package for a while, checking the
code is far from straightforward.

Ian.


-- 
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: 
https://lists.debian.org/21926.39019.476429.927...@chiark.greenend.org.uk

Re: The Spirit of Free Software, or The Reality

2015-07-15 Thread Marc Haber

On Wed, 15 Jul 2015 14:56:28 +1000, Ben Finney
ben+deb...@benfinney.id.au wrote:
Whatever my position ends up being on that, I do have a firm position on
another aspect: I greatly appreciate that you're grappling with these
issues in Mozilla products, and working to keep Debian high-quality and
free.

Thank you, Mike.

Amen. Packaging Mozilla software surely is hard work just for its
obiquity, and the work is done just splendidly.

Greetings
Marc
-- 
-- !! No courtesy copies, please !! -
Marc Haber |Questions are the | Mailadresse im Header
Mannheim, Germany  | Beginning of Wisdom  | http://www.zugschlus.de/
Nordisch by Nature | Lt. Worf, TNG Rightful Heir | Fon: *49 621 72739834


--
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: https://lists.debian.org/e1zfklg-hl...@swivel.zugschlus.de

Re: The Spirit of Free Software, or The Reality

Marc Haber writes (Re: The Spirit of Free Software, or The Reality):
 On Wed, 15 Jul 2015 14:56:28 +1000, Ben Finney
 ben+deb...@benfinney.id.au wrote:
 Whatever my position ends up being on that, I do have a firm position on
 another aspect: I greatly appreciate that you're grappling with these
 issues in Mozilla products, and working to keep Debian high-quality and
 free.
 
 Amen. Packaging Mozilla software surely is hard work just for its
 obiquity, and the work is done just splendidly.

I should say that I agree with this and my previous message should not
be read as a criticism of Mike, who is indeed dealing with very tricky
problems.

Ian.


-- 
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: 
https://lists.debian.org/21926.19736.832540.256...@chiark.greenend.org.uk

Re: The Spirit of Free Software, or The Reality

2015-07-15 Thread Bas Wijnen

On Wed, Jul 15, 2015 at 01:26:16PM +0900, Mike Hommey wrote:
On Wed, Jul 15, 2015 at 03:51:42AM +0200, Bas Wijnen wrote:
On Wed, Jul 15, 2015 at 01:06:28AM +0200, Jakub Wilk wrote:
POST
https://safebrowsing.google.com/safebrowsing/downloads?client=Iceweaselappver=38.1.0pver=2.2key=no-google-api-key
+ a few dozens of GET requests to https://safebrowsing.google.com/

So nothing serious here. It's just casually violating your privacy.

I disagree that the safebrowsing part is not serious, especially considering
that it continues to send a message there on every new page you visit. Best
case the only thing that happens is that Google checks that you aren't
visiting
a dangerous site. But really? Does anyone believe that Google does not
store
this data to monitor browsing habits?

FUD is easy. How about documenting yourself on how Safe browsing
actually works?

Please don't be so harsh. FUD is about trying to mislead people into thinking
untrue bad things about someone. I have no bad intentions, and I don't see why
you would think that I do.

I have some experience with safe browsing, but indeed I have not looked up how
it works. I do know that it continuously sends data to Google, and I have
quite a bit of confidence in their capability and willingness to use that data
for tracking. From your description it sounds like that is not trivial, but
there are smart people at Google, and they have near infinite resources.

Hint: urls are _never_ sent to Google. The worst thing
that Google can know is that the _hash_ of /some/ url you went to, has the
first n bits matching the first n bits of the hash of one (or multiple)
of the known malware of phishing urls. Nothing more.

That sounds good, and I believe you that is how it's supposed to work, but I
can't quite match it with my observations. The first time I encountered safe
browsing was when I was running wireshark for an unrelated reason. I saw lots
of packets going to a remote server even though I wasn't doing anything on the
network yet. So I checked which host it was, and it turned out to be Google.
Given that every product they have seems to be targeting maximum gathering of
personal information on people, I worry when my computer is sending a lot of
data to them without me asking for it.

I also note that it sent requests there all the time. I wasn't even doing
anything with my browser, and I didn't have any sites open that would obviously
keep contact with the server. I don't remember exactly what happened, but I do
remember that it looked like Iceweasel was sending a lot of information about
me to Google.

As Jakub was saying: just starting it up without even visiting a site yet will
do a POST and a *few dozen* GET requests. Shouldn't it be waiting with its
checks until it actually knows what to check? What is it sending them at
browser startup?

So I wanted to make it stop; I can live without the safe browsing feature. I
couldn't find it anywhere in the regular preferences. In about:config I
searched for it and there is an enabled flag, which I turned off, but that
didn't actually stop the traffic (is that a bug, or does it disable something
in a different way?) Eventually I managed to stop it by replacing all the
safebrowsing related urls with empty strings. I don't like that I need to do
that much work to prevent my computer from contacting Google. I also don't
think I am obligated to find out the technical details of the protocol before
I'm allowed to complain about it.

All that being said, I agree with Ben that the Iceweasel packaging in Debian is
excellent, and I'm happy to know that this is the case.

Thanks,
Bas

--
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: https://lists.debian.org/20150715121808.gp8...@fmf.nl

Re: The Spirit of Free Software, or The Reality

2015-07-15 Thread Adam Borowski

On Wed, Jul 15, 2015 at 12:16:36PM +0200, Marcus Rohrmoser wrote:
 https://requestpolicycontinued.github.io/ comes to a rescue.

Note that while requestpolicycontinued is capable to do everything original
requestpolicy did, in its default mode it's just a poor ad blocker, strictly
weaker than Adblock Plus.  There is a switch to make it block third-party
servers by default, but the documentation discourages that.

I can't fathom why they would do such a thing as this throws away the whole
concept, but as it stands, I wouldn't recommend requestpolicycontinued to
unwary users.

-- 
// If you believe in so-called intellectual property, please immediately
// cease using counterfeit alphabets.  Instead, contact the nearest temple
// of Amon, whose priests will provide you with scribal services for all
// your writing needs, for Reasonable and Non-Discriminatory prices.


-- 
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: https://lists.debian.org/20150715121826.ga26...@angband.pl

Re: The Spirit of Free Software, or The Reality

2015-07-15 Thread The Wanderer

On 07/15/2015 at 08:18 AM, Bas Wijnen wrote:

 As Jakub was saying: just starting it up without even visiting a site
 yet will do a POST and a *few dozen* GET requests.  Shouldn't it be
 waiting with its checks until it actually knows what to check?  What
 is it sending them at browser startup?
 
 So I wanted to make it stop; I can live without the safe browsing
 feature.  I couldn't find it anywhere in the regular preferences.  In
 about:config I searched for it and there is an enabled flag, which
 I turned off, but that didn't actually stop the traffic (is that a
 bug, or does it disable something in a different way?)

I've seen this (or something similar) discussed on Mozilla lists
semi-recently. I believe there was a bug opened about it, but I don't
recall the bug number or what the outcome (if any yet) may have been.

-- 
   The Wanderer

The reasonable man adapts himself to the world; the unreasonable one
persists in trying to adapt the world to himself. Therefore all
progress depends on the unreasonable man. -- George Bernard Shaw



signature.asc
Description: OpenPGP digital signature

Re: The Spirit of Free Software, or The Reality

2015-07-15 Thread Marcus Rohrmoser

Dear Nikolaus,

I have to disagree.

 I'm not sure if that's really as serious as you make it sound. Let me
 ask you this:
 
 1. Were you surprised by this?

Yes.

 I was certainly not, this is about what I
would have guessed.

Why?

 If a program does what I expect it to do, I'm not
sure if me starting it is violating my privacy“.

If I didn’t tell it to access a webpage I wouldn’t expect it to.

Accessing various webpages is necessary for the functions that
Firefox provides. So complaining about this is a little like
complaining that my car needs fuel - unfortunate, but difficult to
avoid if I want to have a car. If you don't want the functions that
Firefox provides, don't use it.

Indeed, staying in the car analogon (that usually fails): question is who’s in 
the driver’s seat. Who decides which directions to take - i.e. pages to access. 
It should be the user's decision. Not the visited website’s (which sadly too 
often is) but definitively not the browser’s own decision.

Even less so in secrecy. And even less so prior ANY USER ACTION requesting so.

 2. Would it be ok if Firefox did all this at the time you visited the
first webpage, rather than at the time of startup?

No.

If not, then what about all the tracking pages that Firefox is going
to load because they're referenced in the page you asked for?
Shouldn't you be much more worried about those?

Thank you mentioning this - yes, acually I am not only worried but annoyed to a 
degree to take action: https://requestpolicycontinued.github.io/ comes to a 
rescue.

Cheers,
M


--
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: https://lists.debian.org/cf383996-93cc-4f4f-9dbb-c5f95d3fe...@mro.name

Re: The Spirit of Free Software, or The Reality

Mike Hommey writes (Re: The Spirit of Free Software, or The Reality):
 On Wed, Jul 15, 2015 at 01:06:28AM +0200, Jakub Wilk wrote:
  GET http://www.ebay.com/favicon.ico
  GET http://en.wikipedia.org/favicon.ico
  GET http://www.yahoo.com/favicon.ico
  GET http://www.google.com/favicon.ico
  GET http://www.amazon.com/favicon.ico
  GET http://www.yahoo.com/favicon.ico
  GET http://www.yahoo.com/favicon.ico
  GET https://en.wikipedia.org/favicon.ico
  GET https://en.wikipedia.org/favicon.ico
  GET https://www.yahoo.com/favicon.ico
  GET https://en.wikipedia.org/favicon.ico
 
 FWIW, those are a consequence of removing supposedly non-free icons from
 the source package. But maybe you'd prefer no icons at all for the list
 of search engines.

Yes.  Frankly I think it is astonishing that we have done this
deliberately.  Do we really think we are enhancing our users' freedom
by doing this ?

Compared to distributing the icon in the package, the user does not
gain the ability to legally modify the icon.  We are not avoiding
exposing us or our users to any legal risks.

Supposely this decision is made by us for ethical reasons (ie, to
uphold our values) but the actual effect is simply to diminish our
users' privacy,.


I would prefer the following things in this order:

1. Where distribution is permitted by an upstream, we make an
   exception for non-free icons in this context.  We already make
   exceptions for the text of licences and I don't see this being a
   problem in principle.

   No reasonable downstream would want to take the trademarked icons
   of a proprietary company, which happens to be bundled into our
   package for privacy and convenience, and produce derivative icons.
   Nor would anyone reasonable expect to be able to do that.

2. No non-DFSG-free icons for search engines.  If no modifiable icon
   is available, no icon.

 BTW, that's something that would need to be resolved once and for all by
 an SPI lawyer, because a) Mozilla's lawyers consider those icons kocher
 as MPL-licensed icons and b) that's a problem broader than just
 iceweasel, as it concerns any package with references to external
 services (and a recurring question on debian-legal).

There isn't a legal problem, surely.  I can't imagine that ebay or
whoever mind us copying their icon in this way.  There is surely a
formal legal copyright licence from ebay which makes the icon
redistributable for this kind of purpose.  As for trademarks, we are
using the icon to refer to the organisation in question, so we do not
even need permission (although there is almost certainly a formal
permission document).

AFAICT no-one has suggested that redistributing unmodified copies of
these icons along with the corresponding search engine thingies in
Iceweasl is contrary to any laws, or contrary to the wishes of the
copyright or trademark owners.

The problem is simply that the icons are non-DFSG-free.

Ian.


-- 
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: 
https://lists.debian.org/21926.19684.439953.87...@chiark.greenend.org.uk

Re: The Spirit of Free Software, or The Reality

Ian Jackson writes (Re: The Spirit of Free Software, or The Reality):
 Right.  I find it disappointing to discover that in Debian we have
 deliberately modified Iceweasl to make this problem worse, even if
   ^
Also, why do I keep doing that ?

e = here are the ones I missed out so far with a few extra spare.

Ian.


-- 
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: 
https://lists.debian.org/21926.45026.984216.363...@chiark.greenend.org.uk

Re: The Spirit of Free Software, or The Reality

Nikolaus Rath writes (Re: The Spirit of Free Software, or The Reality):
 On Jul 15 2015, Ian Jackson ijack...@chiark.greenend.org.uk wrote:
  If I use Iceweasl to visit the EFF's web pages, over TLS, I see no
  reason why I should be exposed to any privacy violations (other than
  any implied by decisons taken by the EFF).
 
 I agree with you. There is no reason, and it would be nice if Iceweasel
 would not violate your privacy if you do so.

Right.  I find it disappointing to discover that in Debian we have
deliberately modified Iceweasl to make this problem worse, even if
only in a modest way.

 However, I am not at all surprised that Iceweasel is doing that. If I
 want privacy, I don't run Iceweasel but something like w3m. That's a lot
 more reliable than changing Iceweasel to not download some icons and
 disable safe browsing.

Well, that may be a realistic assessment.  But others in this thread
have suggested possible ways to gain more assurance about the
behaviour of programs like Iceweasel.  I think people who want to do
that deserver our moral and practical support.

And one thing we could easily do (well, easily from a technical point
of view, if we could agree to do it) would be to not download the
icons.  AIUI downloading the icons was a change that was made in
Debian for DFSG reasons.

Thanks,
Ian.


-- 
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: 
https://lists.debian.org/21926.44266.664357.850...@chiark.greenend.org.uk

Re: The Spirit of Free Software, or The Reality

On Wed, Jul 15, 2015 at 01:07:00PM +0100, Ian Jackson wrote:
  BTW, that's something that would need to be resolved once and for all by
  an SPI lawyer, because a) Mozilla's lawyers consider those icons kocher
  as MPL-licensed icons and b) that's a problem broader than just
  iceweasel, as it concerns any package with references to external
  services (and a recurring question on debian-legal).
 
 There isn't a legal problem, surely.  I can't imagine that ebay or
 whoever mind us copying their icon in this way.  There is surely a
 formal legal copyright licence from ebay which makes the icon
 redistributable for this kind of purpose.  As for trademarks, we are
 using the icon to refer to the organisation in question, so we do not
 even need permission (although there is almost certainly a formal
 permission document).
 
 AFAICT no-one has suggested that redistributing unmodified copies of
 these icons along with the corresponding search engine thingies in
 Iceweasl is contrary to any laws, or contrary to the wishes of the
 copyright or trademark owners.
 
 The problem is simply that the icons are non-DFSG-free.

I'm not even convinced it's a non-DFSG-freeness problem. You know what?
(IANAL opinion here) If upstream is telling me these files are MPL-kocher,
I have no reason not to believe them. MPL is DFSG-free, right? Now,
surely, you can't modify company logos without some legal boundaries,
but those come from trademark laws. Guess what, the same freaking
problem exists with the Debian DFSG-free logo!

I, myself, find our DFSG-freeness pickiness going too far, and I'm sick
of this icon thing. So, here's what I'm going to do: unless I hear
non-IANAL objection until the next upstream release due on august 11
(and I'm BCCing the DPL in case he wants to have the SPI lawyer(s) look
into this), I will remove the replacement of the bundled icons with
urls.

Mike


-- 
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: https://lists.debian.org/20150715221703.gd19...@glandium.org

Re: Re: The Spirit of Free Software, or The Reality

On Wed, Jul 15, 2015 at 03:50:18PM +, Christoph Riehl wrote:
On Wed, Jul 15, 2015 at 03:51:42AM +0200, Bas Wijnen wrote:
On Wed, Jul 15, 2015 at 01:06:28AM +0200, Jakub Wilk wrote:
POST
https://safebrowsing.google.com/safebrowsing/downloads?client=Iceweaselappver=38.1.0pver=2.2key=no-google-api-key
+ a few dozens of GET requests to https://safebrowsing.google.com/

So nothing serious here. It's just casually violating your privacy.

I disagree that the safebrowsing part is not serious, especially
considering
that it continues to send a message there on every new page you
visit. Best
case the only thing that happens is that Google checks that you
aren't visiting
a dangerous site. But really? Does anyone believe that Google
does not store
this data to monitor browsing habits?

FUD is easy. How about documenting yourself on how Safe browsing
actually works? Hint: urls are _never_ sent to Google. The worst thing
that Google can know is that the _hash_ of /some/ url you went to,
has the
first n bits matching the first n bits of the hash of one (or multiple)
of the known malware of phishing urls. Nothing more.

Yeah, it's not like google would have a giant scanning tool that
downloads the content, processes, parses, classifies every web page out
there.
Google will of course never ever generate and store in one of their
databases a hash of the url of each page they process. No, never ever
they will do that.
Also, google will never ever store your requests. They never store
anything for tra(ffi)cking.

Let's say they do. So what? The only thing they can get from the first n
bits of the hash is that you visited one of possibly hundreds of
thousands of urls with the same hash first n bits that also matches the
first n bits of the hash of some known malware. Wow, that's going to
make tracking so much easier than, say, ads or analytics.

Mike

Re: The Spirit of Free Software, or The Reality

On Wed, Jul 15, 2015 at 02:18:08PM +0200, Bas Wijnen wrote:
On Wed, Jul 15, 2015 at 01:26:16PM +0900, Mike Hommey wrote:
On Wed, Jul 15, 2015 at 03:51:42AM +0200, Bas Wijnen wrote:
On Wed, Jul 15, 2015 at 01:06:28AM +0200, Jakub Wilk wrote:
POST
https://safebrowsing.google.com/safebrowsing/downloads?client=Iceweaselappver=38.1.0pver=2.2key=no-google-api-key
+ a few dozens of GET requests to https://safebrowsing.google.com/

So nothing serious here. It's just casually violating your privacy.

I disagree that the safebrowsing part is not serious, especially
considering
that it continues to send a message there on every new page you visit.
Best
case the only thing that happens is that Google checks that you aren't
visiting
a dangerous site. But really? Does anyone believe that Google does not
store
this data to monitor browsing habits?

FUD is easy. How about documenting yourself on how Safe browsing
actually works?

Please don't be so harsh. FUD is about trying to mislead people into thinking
untrue bad things about someone. I have no bad intentions, and I don't see
why
you would think that I do.

Because you were misleading people into thinking untrue bad things about
safe browsing.

(snip)

I'm not sure which version of the protocol iceweasel uses nowadays, but
this is the protocol spec for v2.2:
https://code.google.com/p/google-safe-browsing/wiki/Protocolv2Spec

Using a POST is part of that.

If you're interested in knowing exactly what's going over the wire, you
can go enable the browser toolbox and watch all the network requests the
browser does.

https://developer.mozilla.org/en-US/docs/Tools/Browser_Toolbox

So I wanted to make it stop; I can live without the safe browsing feature. I
couldn't find it anywhere in the regular preferences.

Security Block reported attach sites
and
Security Block reported web forgeries

Mike

Re: The Spirit of Free Software, or The Reality