7 ms·

Stallman calls autoupdates a "universal backdoor".

est31 6y ago
He is right in a sense, and cases like this give him proof, but on the other hand, most people don't see the point in patching their software. They'd just keep it around unpatched, while connecting it to the network. Is millions of vulnerable devices better than giving vendors of some software the ability to remotely patch their software?
- macksd 6y ago
  There's a third possibility, and I think it's Stallman's ideal computing landscape: all users care deeply about the code running on their machines and they are competent in applying and vetting patches, building from source, etc. It's unrealistic, sure, but it sounds nice right about now.
  - TeMPOraL 6y ago
    I don't think it was ever Stallman's point. He is smart enough to recognize most users aren't going to be technically competent. He's also smart enough to recognize is that most people are going to have someone technically competent in their circle of friends, or within few minutes of walking distance. So people need a set of rights that will allow them to ask or hire someone else to care for their computing. In this sense, Free Software is like Right to Repair - it isn't about making individuals technically competent; it's about enabling local markets of specialists.
  - est31 6y ago
    I think back when he posted it, it might have been possible for sufficiently motivated and talented individuals to do such vetting, albeit even then it would have been a stretch. Nowadays the amount of code running on various devices in a single home has increased so dramatically... Think of TV remotes. They used to work with infrared. Nowadays, there are bluetooth remotes (not sure how widely deployed they are, but at least some vendors offer them instead of IR remotes). An infrared device can be send only. No way to hack it even if you have an infrared sender in range. The pattern transmitted was quite simple. The bluetooth protocol however requires both sending and receiving ability. Bluetooth stack is in the tens of thousands of lines range. There will be a security bug somewhere...
    - littlecranky67 6y ago
      This TV Remote exactly clearly gets to the point: What do you think is more likely, a malicious hacker driving a van and parking in front of your house? Just to exploit the TV remote via Bluetooth, a device that has no sensitive data, is not connected to the internet and can only be used to make TV inputs like switching channels? Or rather that your TV vendor like Samsung or LG decide one day that they offer a firmware "update" that will log what you watch on the TV, upload screenshot of the device and installed App to the cloud and sell to 3rd parties? My bet is on the later, and it exactly makes the point that auto-update is more dangerous than having a security flaw in a bluetooth TV remote.
    - macksd 6y ago
      I agree it's unrealistic, but I think Stallman and many others like him would rather forego the benefits of a bluetooth remote than embrace the status quo. OpenBSD for instance, was recently discussed on here for dropping a Bluetooth stack over concerns about the correctness of the implementation, and no one has bothered to write a better one.
  - mcv 6y ago
    Not everybody needs to do that, but then you need to rely on people you can trust. Of course we already do that to some extent in app stores: I don't install something from unknown developers that requires all sorts of permissions it shouldn't need, I do install from developers I think I can trust. But if I don't trust them, I lack the ability to inspect their code. That's indeed the big thing that's lacking.
- hulitu 6y ago
  > He is right in a sense, and cases like this give him proof, but on the other hand, most people don't see the point in patching their software. We are not talking about patching. We are talking about updating. > They'd just keep it around unpatched, while connecting it to the network. Is millions of vulnerable devices better than giving vendors of some software the ability to remotely patch their software? Yes. Vendors do not patch their SW. For the average SW developer fixing bugs is like castor oil. Remember the forced transition from Win 7 to Win 10 when a good OS was replaced by an abomination ? And no, 10 is not better securitywise than 7. There are lot of RCEs in 10. Did you ever play an EA game ? With Origin doing a 4GB update before playing ? On a 25 Mbps internet connection ? So for me if you have a security patch for your sw i will apply it. Maybe after some buffer period in the case of known offenders (MS) depending on severity. If it's "performance and usability improvements" just forgetit. If you did't bother to write a changelog for your SW i will not waste my time and money (an internet connection is not free ) updating it.
  - Closi 6y ago
    What stops them bundling something malicious into the “security patch” and then not writing it into the change log?
    - rob74 6y ago
      App review... maybe? But the review (especially on Android) would have to be much more careful than it is nowadays...
    - Silhouette 6y ago
      Traditionally, when someone deliberately does something that causes significant harm to someone else, we address that by giving them a chance to defend their actions in court and if their defence is not acceptable we penalise them. It is strange how easily we forget normal behaviour as soon as technology comes into the picture. If you had a shower fan/light that broke, and the manufacturer supplied a new model to replace it that had a working fan but no light and also an undisclosed camera and connectivity that sent everything it saw home to the manufacturer, no-one would be debating the situation. People would be going to jail.
- z3t4 6y ago
  Basically all phones are behind a NAT/firewall. You can't connect to them directly.
  - bonzini 6y ago
    They can connect to whatever they want, it's more than enough.
    - est31 6y ago
      Plus many services can send push messages to the phone. E.g. Whatsapp. Bezos for example was hacked through a Whatsapp message containing an exploit.
  - BelenusMordred 6y ago
    Until they turn on ADB, then it's a free for all. https://www.bleepingcomputer.com/news/security/tens-of-thousands-of-android-devices-are-exposing-their-debug-port/ https://www.bleepingcomputer.com/news/security/tens-of-thous...
  - rjmunro 6y ago
    On my home WiFi, my phone is on IPv6, and therefore not behind NAT (it is on a NAT address for IPv4, though). I've not done any super-geeky things to enable this, it's a standard router from a mainstream internet provider. Pinging the IPv6 address from outside doesn't seem to work - I guess there is some sort of firewalling going on.
- yread 6y ago
  Maybe I'm a luddite but updates are not always necessary. It's a barcode app, what updates does it need? Is there a cve that needs to be patched? No? Then I don't need a new version
  - kace91 6y ago
    "is there a CVE" is not a question that regular people can, will, or in my opinion even should ask. I mean, if they do, all the better, but my point is that advanced enough tech knowledge should not be a requirement for a safe system.
  - Scoundreller 6y ago
    I’m usually like this. Then my bank’s app refused to launch until I updated. They re-designed it. When I went to click my usual “schedule payment” button on a bill payment, it just said “Coming Soon”. I wasn’t a happy person about it. Big Canadian bank too. US$65b mkt cap.
    - jobigoud 6y ago
      I never use my bank app because I don't fully trust my phone but they redesigned their website to be more mobile friendly. Now I can only see 10 operations at once instead of 30 before, and I can no longer sort by amount... When I complained 2 years ago about it my banker told me to participate in their feedback program... Now they send me market research polls about future products and features, no way to report usability issues, it's not even run by the bank itself...
      - Silhouette 6y ago
        Financial services companies do seem to be particularly bad when it comes to UIs for their customers. Both awful apps and broken "mobile-first" sites seem to be par for the course these days. A few do try to do better, but the reality is that most people don't change banks for much more serious reasons than this, so the banks have a financial incentive to just throw some mostly workable junk together and ship it as cheaply as possible. :-(
- littlecranky67 6y ago
  I use iOS and have App auto-updates disabled (not the system update). We are at a point where auto-updates are more risky than the security flaw itself - especially since iOS has a pretty good sandbox, especially since its impossible for one app to access the data of another. Additionally, the App usually connects to a pretty limited set of servers, and is not publicly reachable. So the attack vector is pretty small. Another point is the often complete change in UI or app behavior and you only find out about when you want it the least. I once had the case where I came out of a bar in the middle of a cold night, tired, had some beers and just wanted to use my Bikesharing app to unlock a freefloating bike to get home - whilst the app decided that it had to introduce a completely new UI and forced me to take an unskippable "guided tour" through the new features right at the spot.
  - g_p 6y ago
    > We are at a point where auto-updates are more risky than the security flaw itself - especially since iOS has a pretty good sandbox, especially since its impossible for one app to access the data of another. Additionally, the App usually connects to a pretty limited set of servers, and is not publicly reachable. So the attack vector is pretty small. I'd have to say that most apps now connect to a rather large number of hosts/servers, and it's getting increasingly untenable to not offer users proper control of this. I get that Apple wants to be "friendly computers", but looking at my firewall logs I'm seeing: - third party audience segmenting - third party analytics - third party static content being fetched - third party ad networks - first or third party generic cloud server connections I think the attack vector on apps is quite significant if you consider the app itself to have been built to monetize data - there's no outbound traffic filtering to check the system isn't leeching user data and/or device identifiers (the latter getting better and hopefully Apple will require consent soon for the ID for advertisers). It's trivial to make an app that leeches a user's contacts regularly to a server, then does anything the developer feels like to build a social graph. See clubhouse. I fear the biggest issue for most users' privacy are the "legitimate" apps they use simply not being built with incentives aligned with their interests, and having access to phone home to any server with anything they can access.
    - 6y ago
- dolmen 6y ago
  And even when you choose to only manually upgrade, carefully looking at the changelog, but it just says "Bugs fixed." The Play Store doesn't give enough information to really judge if the upgrade is necessary.
  - dividuum 6y ago
    "Bug fixes and performance improvements". ~AirBnB
    - pieter_mj 6y ago
      My Nokia 7.2 has had so many performance improvement updates I fully expect it to be faster than the latest iPhone flagship.
- Silhouette 6y ago
  We need a culture that distinguishes between truly necessary updates like security ones and general updates that change functionality and interfaces. One type is essential and we want to encourage everyone to install those promptly. The other should always be optional and the changes being made should always be transparent. Bundling the two is a common but user-hostile behaviour. This separation should be the price of admission for software developers who want to use online updates, and by now there is probably a need for real laws to regulate the industry since firstly it is very clear that it will not regulate itself effectively and secondly it is no longer just random applications but essentials like operating systems, web browsers and even the software controlling your car that are being treated in this cavalier way.
  - rjmunro 6y ago
    This would be nice, but a developer could still publish a malicious update as an important security fix. Also it gets very hard for developers to keep track of past versions and apply new fixes to them, when they also have to apply fixes to the new versions.
    - Silhouette 6y ago
      Also it gets very hard for developers to keep track of past versions and apply new fixes to them, when they also have to apply fixes to the new versions. Then maybe they release too often? I have been developing software professionally for a long time, much of it code that needed to be high quality. I have never worked on such a team that couldn't keep track of its own software, often over a period of years or even decades, and backport fixes when necessary. Yes, it's less convenient for the developers than just having a single version that users are forced to update constantly if they want fixes. But it is achievable if you drop the pretence that every minor change in functionality or appearance must be pushed into production instantly through some CD system, which is of course a luxury that only those running hosted software have anyway.
qwertay 6y ago
Stallman is almost always right but nothing he says is particularly surprising or useful. Yes auto updates allow delivery of malware but its not like manual updating was any better. No user was auditing changes before hitting the update.
- edoceo 6y ago
  But if you were slow updating you could avoid a malware once it was known.
  - philshem 6y ago
    Who will detect the malware if we are all slow to update?
    - jobigoud 6y ago
      The early adopters. There are always people that will weight that risk of latest & greatest and vs buggy differently, it should be a choice. Especially for apps that don't have a beta testing or early bird channel.
  - ksml 6y ago
    Also if you were slow updating, you could avoid critical security patches (and many people did)
    - malux85 6y ago
      Yeah and missing security updates was WAY more common, autoupdates is the lesser of the two evils by far ...
    - simfoo 6y ago
      Which affect the OS mostly and not individual apps. Funnily enough OS updates are usually not automatic. Which I think is a good thing because vendors keep mixing them with "feature updates" which end up making things worse (looking at you Samsung). I'd love for Google to take away the security update channel from the phone vendors and auto-update ONLY security-related things through that.
davidhyde 6y ago
I didn’t know that automatic app updates could be turned off until I just tried it now in iOS, thanks! Just a side note but think that Google and Apple took way too long to provide built in apps for using your phone as a flashlight or scanning a QR code. They allowed this malware cottage industry to flourish.
- sneak 6y ago
  iOS these days also grants Apple full automatic OS updates by default, too. You can turn it off, but you have to dig in settings. During initial iOS 14 setup it has a screen telling you it's turning autoupdates on, but you're not allowed to opt out there. Unattended upgrades are a remote code execution vulnerability.
amatecha 6y ago
I used to think he was "crazy" and I disregarded a lot of what he said. Recently I was reading the FSF website and I realized a lot of the stuff on there is actually full of some pretty good points, even if it's sometimes presented in a slightly "judgemental" or perhaps emotionally-charged manner. Some of the statements might not be 100% perfectly factually precise, but the jist of them is generally on-point. I have recently been a LOT more cognizant of the ways that corporations and software outfits exert control over the people who use their software. Now that I see it more, and look for it more, I am getting suuuper unhappy with the current state of computing. :( A lot of the complaints I've had about software and computers in the recent years are generally the direct result of the software motivations of for-profit/proprietary software vendors. I can still use all the OSS stuff just as I always have, and it's actually the most stable and reliable stuff I use.
- zulban 6y ago
  I've seen Stallman live, and in many interviews. The guy is in fact "crazy" in a loose sense. Really. Unfortunately, he is also often right. It's not a useful combination.

He is right in a sense, and cases like this give him proof, but on the other hand, most people don't see the point in patching their software. They'd just keep it around unpatched, while connecting it to the network. Is millions of vulnerable devices better than giving vendors of some software the ability to remotely patch their software?

macksd 6y ago
There's a third possibility, and I think it's Stallman's ideal computing landscape: all users care deeply about the code running on their machines and they are competent in applying and vetting patches, building from source, etc. It's unrealistic, sure, but it sounds nice right about now.
- TeMPOraL 6y ago
  I don't think it was ever Stallman's point. He is smart enough to recognize most users aren't going to be technically competent. He's also smart enough to recognize is that most people are going to have someone technically competent in their circle of friends, or within few minutes of walking distance. So people need a set of rights that will allow them to ask or hire someone else to care for their computing. In this sense, Free Software is like Right to Repair - it isn't about making individuals technically competent; it's about enabling local markets of specialists.
- est31 6y ago
  I think back when he posted it, it might have been possible for sufficiently motivated and talented individuals to do such vetting, albeit even then it would have been a stretch. Nowadays the amount of code running on various devices in a single home has increased so dramatically... Think of TV remotes. They used to work with infrared. Nowadays, there are bluetooth remotes (not sure how widely deployed they are, but at least some vendors offer them instead of IR remotes). An infrared device can be send only. No way to hack it even if you have an infrared sender in range. The pattern transmitted was quite simple. The bluetooth protocol however requires both sending and receiving ability. Bluetooth stack is in the tens of thousands of lines range. There will be a security bug somewhere...
  - littlecranky67 6y ago
    This TV Remote exactly clearly gets to the point: What do you think is more likely, a malicious hacker driving a van and parking in front of your house? Just to exploit the TV remote via Bluetooth, a device that has no sensitive data, is not connected to the internet and can only be used to make TV inputs like switching channels? Or rather that your TV vendor like Samsung or LG decide one day that they offer a firmware "update" that will log what you watch on the TV, upload screenshot of the device and installed App to the cloud and sell to 3rd parties? My bet is on the later, and it exactly makes the point that auto-update is more dangerous than having a security flaw in a bluetooth TV remote.
  - macksd 6y ago
    I agree it's unrealistic, but I think Stallman and many others like him would rather forego the benefits of a bluetooth remote than embrace the status quo. OpenBSD for instance, was recently discussed on here for dropping a Bluetooth stack over concerns about the correctness of the implementation, and no one has bothered to write a better one.
- mcv 6y ago
  Not everybody needs to do that, but then you need to rely on people you can trust. Of course we already do that to some extent in app stores: I don't install something from unknown developers that requires all sorts of permissions it shouldn't need, I do install from developers I think I can trust. But if I don't trust them, I lack the ability to inspect their code. That's indeed the big thing that's lacking.
hulitu 6y ago
> He is right in a sense, and cases like this give him proof, but on the other hand, most people don't see the point in patching their software. We are not talking about patching. We are talking about updating. > They'd just keep it around unpatched, while connecting it to the network. Is millions of vulnerable devices better than giving vendors of some software the ability to remotely patch their software? Yes. Vendors do not patch their SW. For the average SW developer fixing bugs is like castor oil. Remember the forced transition from Win 7 to Win 10 when a good OS was replaced by an abomination ? And no, 10 is not better securitywise than 7. There are lot of RCEs in 10. Did you ever play an EA game ? With Origin doing a 4GB update before playing ? On a 25 Mbps internet connection ? So for me if you have a security patch for your sw i will apply it. Maybe after some buffer period in the case of known offenders (MS) depending on severity. If it's "performance and usability improvements" just forgetit. If you did't bother to write a changelog for your SW i will not waste my time and money (an internet connection is not free ) updating it.
- Closi 6y ago
  What stops them bundling something malicious into the “security patch” and then not writing it into the change log?
  - rob74 6y ago
    App review... maybe? But the review (especially on Android) would have to be much more careful than it is nowadays...
  - Silhouette 6y ago
    Traditionally, when someone deliberately does something that causes significant harm to someone else, we address that by giving them a chance to defend their actions in court and if their defence is not acceptable we penalise them. It is strange how easily we forget normal behaviour as soon as technology comes into the picture. If you had a shower fan/light that broke, and the manufacturer supplied a new model to replace it that had a working fan but no light and also an undisclosed camera and connectivity that sent everything it saw home to the manufacturer, no-one would be debating the situation. People would be going to jail.
z3t4 6y ago
Basically all phones are behind a NAT/firewall. You can't connect to them directly.
- bonzini 6y ago
  They can connect to whatever they want, it's more than enough.
  - est31 6y ago
    Plus many services can send push messages to the phone. E.g. Whatsapp. Bezos for example was hacked through a Whatsapp message containing an exploit.
- BelenusMordred 6y ago
  Until they turn on ADB, then it's a free for all. https://www.bleepingcomputer.com/news/security/tens-of-thousands-of-android-devices-are-exposing-their-debug-port/ https://www.bleepingcomputer.com/news/security/tens-of-thous...
- rjmunro 6y ago
  On my home WiFi, my phone is on IPv6, and therefore not behind NAT (it is on a NAT address for IPv4, though). I've not done any super-geeky things to enable this, it's a standard router from a mainstream internet provider. Pinging the IPv6 address from outside doesn't seem to work - I guess there is some sort of firewalling going on.
yread 6y ago
Maybe I'm a luddite but updates are not always necessary. It's a barcode app, what updates does it need? Is there a cve that needs to be patched? No? Then I don't need a new version
- kace91 6y ago
  "is there a CVE" is not a question that regular people can, will, or in my opinion even should ask. I mean, if they do, all the better, but my point is that advanced enough tech knowledge should not be a requirement for a safe system.
- Scoundreller 6y ago
  I’m usually like this. Then my bank’s app refused to launch until I updated. They re-designed it. When I went to click my usual “schedule payment” button on a bill payment, it just said “Coming Soon”. I wasn’t a happy person about it. Big Canadian bank too. US$65b mkt cap.
  - jobigoud 6y ago
    I never use my bank app because I don't fully trust my phone but they redesigned their website to be more mobile friendly. Now I can only see 10 operations at once instead of 30 before, and I can no longer sort by amount... When I complained 2 years ago about it my banker told me to participate in their feedback program... Now they send me market research polls about future products and features, no way to report usability issues, it's not even run by the bank itself...
    - Silhouette 6y ago
      Financial services companies do seem to be particularly bad when it comes to UIs for their customers. Both awful apps and broken "mobile-first" sites seem to be par for the course these days. A few do try to do better, but the reality is that most people don't change banks for much more serious reasons than this, so the banks have a financial incentive to just throw some mostly workable junk together and ship it as cheaply as possible. :-(
littlecranky67 6y ago
I use iOS and have App auto-updates disabled (not the system update). We are at a point where auto-updates are more risky than the security flaw itself - especially since iOS has a pretty good sandbox, especially since its impossible for one app to access the data of another. Additionally, the App usually connects to a pretty limited set of servers, and is not publicly reachable. So the attack vector is pretty small. Another point is the often complete change in UI or app behavior and you only find out about when you want it the least. I once had the case where I came out of a bar in the middle of a cold night, tired, had some beers and just wanted to use my Bikesharing app to unlock a freefloating bike to get home - whilst the app decided that it had to introduce a completely new UI and forced me to take an unskippable "guided tour" through the new features right at the spot.
- g_p 6y ago
  > We are at a point where auto-updates are more risky than the security flaw itself - especially since iOS has a pretty good sandbox, especially since its impossible for one app to access the data of another. Additionally, the App usually connects to a pretty limited set of servers, and is not publicly reachable. So the attack vector is pretty small. I'd have to say that most apps now connect to a rather large number of hosts/servers, and it's getting increasingly untenable to not offer users proper control of this. I get that Apple wants to be "friendly computers", but looking at my firewall logs I'm seeing: - third party audience segmenting - third party analytics - third party static content being fetched - third party ad networks - first or third party generic cloud server connections I think the attack vector on apps is quite significant if you consider the app itself to have been built to monetize data - there's no outbound traffic filtering to check the system isn't leeching user data and/or device identifiers (the latter getting better and hopefully Apple will require consent soon for the ID for advertisers). It's trivial to make an app that leeches a user's contacts regularly to a server, then does anything the developer feels like to build a social graph. See clubhouse. I fear the biggest issue for most users' privacy are the "legitimate" apps they use simply not being built with incentives aligned with their interests, and having access to phone home to any server with anything they can access.
  - 6y ago
dolmen 6y ago
And even when you choose to only manually upgrade, carefully looking at the changelog, but it just says "Bugs fixed." The Play Store doesn't give enough information to really judge if the upgrade is necessary.
- dividuum 6y ago
  "Bug fixes and performance improvements". ~AirBnB
  - pieter_mj 6y ago
    My Nokia 7.2 has had so many performance improvement updates I fully expect it to be faster than the latest iPhone flagship.
Silhouette 6y ago
We need a culture that distinguishes between truly necessary updates like security ones and general updates that change functionality and interfaces. One type is essential and we want to encourage everyone to install those promptly. The other should always be optional and the changes being made should always be transparent. Bundling the two is a common but user-hostile behaviour. This separation should be the price of admission for software developers who want to use online updates, and by now there is probably a need for real laws to regulate the industry since firstly it is very clear that it will not regulate itself effectively and secondly it is no longer just random applications but essentials like operating systems, web browsers and even the software controlling your car that are being treated in this cavalier way.
- rjmunro 6y ago
  This would be nice, but a developer could still publish a malicious update as an important security fix. Also it gets very hard for developers to keep track of past versions and apply new fixes to them, when they also have to apply fixes to the new versions.
  - Silhouette 6y ago
    Also it gets very hard for developers to keep track of past versions and apply new fixes to them, when they also have to apply fixes to the new versions. Then maybe they release too often? I have been developing software professionally for a long time, much of it code that needed to be high quality. I have never worked on such a team that couldn't keep track of its own software, often over a period of years or even decades, and backport fixes when necessary. Yes, it's less convenient for the developers than just having a single version that users are forced to update constantly if they want fixes. But it is achievable if you drop the pretence that every minor change in functionality or appearance must be pushed into production instantly through some CD system, which is of course a luxury that only those running hosted software have anyway.

qwertay 6y ago

Stallman is almost always right but nothing he says is particularly surprising or useful. Yes auto updates allow delivery of malware but its not like manual updating was any better. No user was auditing changes before hitting the update.

edoceo 6y ago
But if you were slow updating you could avoid a malware once it was known.
- philshem 6y ago
  Who will detect the malware if we are all slow to update?
  - jobigoud 6y ago
    The early adopters. There are always people that will weight that risk of latest & greatest and vs buggy differently, it should be a choice. Especially for apps that don't have a beta testing or early bird channel.
- ksml 6y ago
  Also if you were slow updating, you could avoid critical security patches (and many people did)
  - malux85 6y ago
    Yeah and missing security updates was WAY more common, autoupdates is the lesser of the two evils by far ...
  - simfoo 6y ago
    Which affect the OS mostly and not individual apps. Funnily enough OS updates are usually not automatic. Which I think is a good thing because vendors keep mixing them with "feature updates" which end up making things worse (looking at you Samsung). I'd love for Google to take away the security update channel from the phone vendors and auto-update ONLY security-related things through that.

davidhyde 6y ago

I didn’t know that automatic app updates could be turned off until I just tried it now in iOS, thanks! Just a side note but think that Google and Apple took way too long to provide built in apps for using your phone as a flashlight or scanning a QR code. They allowed this malware cottage industry to flourish.

sneak 6y ago
iOS these days also grants Apple full automatic OS updates by default, too. You can turn it off, but you have to dig in settings. During initial iOS 14 setup it has a screen telling you it's turning autoupdates on, but you're not allowed to opt out there. Unattended upgrades are a remote code execution vulnerability.

amatecha 6y ago

I used to think he was "crazy" and I disregarded a lot of what he said. Recently I was reading the FSF website and I realized a lot of the stuff on there is actually full of some pretty good points, even if it's sometimes presented in a slightly "judgemental" or perhaps emotionally-charged manner. Some of the statements might not be 100% perfectly factually precise, but the jist of them is generally on-point. I have recently been a LOT more cognizant of the ways that corporations and software outfits exert control over the people who use their software. Now that I see it more, and look for it more, I am getting suuuper unhappy with the current state of computing. :( A lot of the complaints I've had about software and computers in the recent years are generally the direct result of the software motivations of for-profit/proprietary software vendors. I can still use all the OSS stuff just as I always have, and it's actually the most stable and reliable stuff I use.

zulban 6y ago
I've seen Stallman live, and in many interviews. The guy is in fact "crazy" in a loose sense. Really. Unfortunately, he is also often right. It's not a useful combination.