4 ms·

I don't get your point, but I'm pretty sure that several GNU/Linux repos contain the version of Unity that pinged Amazon's servers to name an example. Where do

I don't get your point, but I'm pretty sure that several GNU/Linux repos contain the version of Unity that pinged Amazon's servers to name an example. Where do you draw the line between spyware and legitimate feature? Where do you draw the line between malware and unintentional faulty code? Review time is a scarce resource, and a bad actor will always find a way to bypass automated checks.

laurent92 6y ago
We should really pay for open-source. The FSF has a page saying it’s correct to charge before delivering OSS software (and the user can redistribute the software with OSS license). We could charge access to Debian repositories for example. For example one repo could have bugfixes, and the broader audience could have a 1-year-old repo. Sure your can build from source, get a zip from a torrent, or find someone who hosts a free mirror of the paid repo, but as a company it’s much easier to get it from the official source, for security compliance. (Btw I’ve always said I’d be happy to spend $200 per year per employee for a desktop OS of macOS quality, so probably much less for our servers). This would offer price discrimination: - Free for individuals who want to spin off a small website, - Paid when you need to prove compliance to security regulations, - Developments still go to the pool of mankind’s marvels, instead of being locked with a commercial license and dying with the company, - Customer can still fork or fix a bug themselves by building from source.
- Aldo_MX 6y ago
  I agree with your point that we should look for a way to pay FOSS maintainers for their time, but my point was that Linux repos are not free of spyware naming the version of Unity that sent what you typed to Amazon Shopping as an example. The line that separates legitimate features and spyware is blurry, especially when a bad default ends up leaking information of the user.
GoblinSlayer 6y ago
Customization is what GPL ensures. You install and run reviewed code.
fsflover 6y ago
> I'm pretty sure that several GNU/Linux repos contain the version of Unity that pinged Amazon's servers to name an example. FLOSS does not prevent malware from existing, but it makes it highly unprobable. You can always find bad examples, but how frequent are they?
kaba0 6y ago
It is enough for one person to notice something strange about a program and it is really easy to fork/revert back to a version with only the needed functionality if source is available. Of course the given bad faith actor responsible for the mischief will be “punished” and will be banned from contribution. With the apparent lack of both viruses and telemetry and the like in libre software even with the laughable default security of linux distros (your home containing basically everything free to read/modify for any user app), I would say that FOSS has quite a good track record in this metric. Nonetheless, a stronger security should be developed/strived for because it still boils down to a trust based system, but it makes me happy that the default of most people is to not cause harm.

laurent92 6y ago

We should really pay for open-source. The FSF has a page saying it’s correct to charge before delivering OSS software (and the user can redistribute the software with OSS license). We could charge access to Debian repositories for example. For example one repo could have bugfixes, and the broader audience could have a 1-year-old repo. Sure your can build from source, get a zip from a torrent, or find someone who hosts a free mirror of the paid repo, but as a company it’s much easier to get it from the official source, for security compliance. (Btw I’ve always said I’d be happy to spend $200 per year per employee for a desktop OS of macOS quality, so probably much less for our servers). This would offer price discrimination: - Free for individuals who want to spin off a small website, - Paid when you need to prove compliance to security regulations, - Developments still go to the pool of mankind’s marvels, instead of being locked with a commercial license and dying with the company, - Customer can still fork or fix a bug themselves by building from source.

Aldo_MX 6y ago
I agree with your point that we should look for a way to pay FOSS maintainers for their time, but my point was that Linux repos are not free of spyware naming the version of Unity that sent what you typed to Amazon Shopping as an example. The line that separates legitimate features and spyware is blurry, especially when a bad default ends up leaking information of the user.

GoblinSlayer 6y ago

Customization is what GPL ensures. You install and run reviewed code.

fsflover 6y ago

> I'm pretty sure that several GNU/Linux repos contain the version of Unity that pinged Amazon's servers to name an example. FLOSS does not prevent malware from existing, but it makes it highly unprobable. You can always find bad examples, but how frequent are they?

kaba0 6y ago

It is enough for one person to notice something strange about a program and it is really easy to fork/revert back to a version with only the needed functionality if source is available. Of course the given bad faith actor responsible for the mischief will be “punished” and will be banned from contribution. With the apparent lack of both viruses and telemetry and the like in libre software even with the laughable default security of linux distros (your home containing basically everything free to read/modify for any user app), I would say that FOSS has quite a good track record in this metric. Nonetheless, a stronger security should be developed/strived for because it still boils down to a trust based system, but it makes me happy that the default of most people is to not cause harm.