5 ms·

Would someone be able to help me understand what is 'Libre Cloud'? Even if your code is released under AGPL or something like that what guarantee do you get tha

Would someone be able to help me understand what is 'Libre Cloud'? Even if your code is released under AGPL or something like that what guarantee do you get that software running and not that plus a tiny delta? So how can cloud be libre when I cannot treat it as nothing but untrusted 3rd party entity? Is the argument here that opendesktop.org is a trusted party?

wolverine876 5y ago
> Even if your code is released under AGPL or something like that what guarantee do you get that software running and not that plus a tiny delta? An interesting question: How do you verify the code running in the 'cloud'? And to rehash an old but relevant point: Practically, you don't know if local FLOSS software is the same as its released code, and you don't even review the code so it doesn't matter, to a degree. You are still operating on trust to some degree. But with local FLOSS software, someone else might review it, which seems difficult for hosted cloud software.
- southerntofu 5y ago
  > Practically, you don't know if local FLOSS software is the same as its released code There's strong efforts for reproducible builds and bootstrappable distros in the past years. NixOS and guix have pioneered the field, but i believe both Debian and ArchLinux are now over 90% reproducible. > seems difficult for hosted cloud software Yes, it's outright impossible. That's why we need effective decentralization via free-software selfhosting solutions, so that you can place your trust in people you actually know and trust, not a "random" centralized free software operator like this one. That's the lesson framasoft.org has learnt when their degooglization campaign was a little too much successful, so they started a new "deframasoftization" campaign which gave birth to the chatons.org federation of non-profit hosts. In the english-speaking world, libreho.st comes to mind.
  - wolverine876 5y ago
    >> Practically, you don't know if local FLOSS software is the same as its released code > There's strong efforts for reproducible builds and bootstrappable distros in the past years. NixOS and guix have pioneered the field, but i believe both Debian and ArchLinux are now over 90% reproducible. That's a valuable step, but few people build their OS. In practice, few people will know if their copy matches the released code. >> seems difficult for hosted cloud software > Yes, it's outright impossible I think it may be possible, but it will require different tools. Remote attestation? Can we verify what is running in memory?
    - southerntofu 5y ago
      > That's a valuable step, but few people build their OS. In practice, few people will know if their copy matches the released code. This is true! That's why guix project has been working on `guix challenge`, which lets you inquire about checksums for a specific package from various repositories, to make sure they are the same. I personally think such an approach is a huge step in making software somewhat-verifiable by non-tech people (although guix is not exactly approachable by that audience, i'm talking about the principle). > Remote attestation? Can we verify what is running in memory? Yes and know. You can if you trust the hardware/software doing the remote attestation. Signal project for instance has argued that a centralized server with Intel SGX "secure enclaves" is the safest we can do. I personally strongly disagree, and i believe vulnerabilities found since then in Apple/Intel/AMD security chips go against that argument. Software security is almost tackled with bootstrappability, reproducibility and "challenges". Hardware/firmware security is an entirely new thing...
      - wolverine876 5y ago
        > Signal project for instance has argued that a centralized server with Intel SGX "secure enclaves" is the safest we can do. I personally strongly disagree, and i believe vulnerabilities found since then in Apple/Intel/AMD security chips go against that argument. If it that isn't 'safest', what do you think is safer (and practical)?
        5y ago
3np 5y ago
It sounds to you like nothing short of fully self-hosted fits the bill? I think it's pretty clear what they're doing: Libre SaaS. Of course you have to trust them with anything going in clear-text on their servers. But you don't have the vendor lock-in you'd have with proprietary alternatives. It can be a great bridge between Google/Apple/Microsoft/etc and self-managed, if nothing else.
10x-dev 5y ago
What guarantees do you have that running apt won't install a rootkit or that the compiler the foss source code was compiled with wasn't malicious? At the end of the day, we largely trust canonical or the distros maintainers to not do anything malicious, even by accident. I see Libre cloud as a similar situation, though with more avenues for larger-scale abuse. Hopefully, just like with other things FOSS, the community will validate that everything is fine and the risk is minimal.
- denton-scratch 5y ago
  > At the end of the day, we largely trust canonical We speak for ourselves!
ineedasername 5y ago
Unless you're reading millions of LOC and compiling everything from source then you also have no guarantee there isn't a delta on any complex software you run. Guarantees are hard to come by. That's where reasonable amounts of risk assessment enter the picture. If you're looking for absolute certainty
- 3np 5y ago
  If you shift the trust just one allegorical bit you don’t necessarily have to read all the code; just compare the sha256 hash with a known git commit and scan through the recent changes in the repo. Compiling from scratch isn’t necessarily such a big deal these days (guix/NixOS/gentoo for base system, locally built containers for orchestrated services). Personally I’m fine with putting some level of trust in the maintainers of Debian apt repos but everything else I definitely do take a look at where it’s coming from and what’s going on. There’s a middle ground between fine-combing the source tree and blindly accepting whatever comes from arbitrary upstreams.
  - ineedasername 5y ago
    Ditto about Debian repos. But as for reading LOC's, comparing the hash won't help if a supply chain attack hit the code before it made it to a commit. I'm not actually advocate reading every LOC. I'm just saying that if you want to use just about anything, some level of trust has to be put in other people & other systems. It should always be a qualified trust though. a trust-but-verify (within reason).
croes 5y ago
Libre neither means secure nor trustworthy.
n3storm 5y ago
Their services are based on Nextcloud, Gitlab and Matrix, where you can export your data and move to another provider or self-hosted in no-time.
galaxyLogic 5y ago
What they could do since they have both a client and the server is make the client encrypt all content that is uploaded and decrypt it when downloaded by those who have a shared decryption key. Wouldn't that make sense?
grumbel 5y ago
Simple answer: It can't, since you don't own the server or the data on it. Long answer: It could be, if proper protocols and data structures would be employed that make it trivial to move the data off the server, mirror it or dual host it on multiple servers at once. So far there is however barely anything that does that, git for version control, IPFS for simple file hosting, but that's about it. The tools to build a "Libre Cloud" don't really exist (and federation is snake oil).
- southerntofu 5y ago
  > It could be, if proper protocols and data structures would be employed that make it trivial to move the data off the server I'm very interested in this domain. Hubzilla has pioneered account migration with the ZOT protocol, and there's discussions in the Jabber/XMPP ecosystem to implement something similar. Personally, i'm curious about going beyond a single protocol and migrating entire server services from a hosting coop to another: https://ttm.sh/dVy.md https://ttm.sh/dVy.md (draft blogpost) > The tools to build a "Libre Cloud" don't really exist (and federation is snake oil). There's Yunohost.org, Freedombox.org and Libreserver.org (ex FreedomBone). They're very cool, and enable non-tech users to selfhost. Why would you say the federation is snake oil?
  - grumbel 5y ago
    > Why would you say the federation is snake oil? With federated services your are still just user@host, completely under the control of whoever owns host. Furthermore the federation aspect is completely optional, if host decides to blacklists some other hosts, there is nothing you can do about it. So I don't see the advantage over the Twitter, Facebook and Co., when everything that makes federation special can be taken away at any moment. Without some public-key crypto or something that allows you to move your identity to another server or better yet, never exist on any specific server to begin with, I just don't see the point. In general, I think the only way to build a "Libre Cloud" is by making the cloud part as stupid as possible. Have the actual app run completely on the client, use the cloud just as dumb object store with little to no awareness of what it is serving.

wolverine876 5y ago

> Even if your code is released under AGPL or something like that what guarantee do you get that software running and not that plus a tiny delta? An interesting question: How do you verify the code running in the 'cloud'? And to rehash an old but relevant point: Practically, you don't know if local FLOSS software is the same as its released code, and you don't even review the code so it doesn't matter, to a degree. You are still operating on trust to some degree. But with local FLOSS software, someone else might review it, which seems difficult for hosted cloud software.

southerntofu 5y ago
> Practically, you don't know if local FLOSS software is the same as its released code There's strong efforts for reproducible builds and bootstrappable distros in the past years. NixOS and guix have pioneered the field, but i believe both Debian and ArchLinux are now over 90% reproducible. > seems difficult for hosted cloud software Yes, it's outright impossible. That's why we need effective decentralization via free-software selfhosting solutions, so that you can place your trust in people you actually know and trust, not a "random" centralized free software operator like this one. That's the lesson framasoft.org has learnt when their degooglization campaign was a little too much successful, so they started a new "deframasoftization" campaign which gave birth to the chatons.org federation of non-profit hosts. In the english-speaking world, libreho.st comes to mind.
- wolverine876 5y ago
  >> Practically, you don't know if local FLOSS software is the same as its released code > There's strong efforts for reproducible builds and bootstrappable distros in the past years. NixOS and guix have pioneered the field, but i believe both Debian and ArchLinux are now over 90% reproducible. That's a valuable step, but few people build their OS. In practice, few people will know if their copy matches the released code. >> seems difficult for hosted cloud software > Yes, it's outright impossible I think it may be possible, but it will require different tools. Remote attestation? Can we verify what is running in memory?
  - southerntofu 5y ago
    > That's a valuable step, but few people build their OS. In practice, few people will know if their copy matches the released code. This is true! That's why guix project has been working on `guix challenge`, which lets you inquire about checksums for a specific package from various repositories, to make sure they are the same. I personally think such an approach is a huge step in making software somewhat-verifiable by non-tech people (although guix is not exactly approachable by that audience, i'm talking about the principle). > Remote attestation? Can we verify what is running in memory? Yes and know. You can if you trust the hardware/software doing the remote attestation. Signal project for instance has argued that a centralized server with Intel SGX "secure enclaves" is the safest we can do. I personally strongly disagree, and i believe vulnerabilities found since then in Apple/Intel/AMD security chips go against that argument. Software security is almost tackled with bootstrappability, reproducibility and "challenges". Hardware/firmware security is an entirely new thing...
    - wolverine876 5y ago
      > Signal project for instance has argued that a centralized server with Intel SGX "secure enclaves" is the safest we can do. I personally strongly disagree, and i believe vulnerabilities found since then in Apple/Intel/AMD security chips go against that argument. If it that isn't 'safest', what do you think is safer (and practical)?
      - 5y ago

3np 5y ago

It sounds to you like nothing short of fully self-hosted fits the bill? I think it's pretty clear what they're doing: Libre SaaS. Of course you have to trust them with anything going in clear-text on their servers. But you don't have the vendor lock-in you'd have with proprietary alternatives. It can be a great bridge between Google/Apple/Microsoft/etc and self-managed, if nothing else.

10x-dev 5y ago

What guarantees do you have that running apt won't install a rootkit or that the compiler the foss source code was compiled with wasn't malicious? At the end of the day, we largely trust canonical or the distros maintainers to not do anything malicious, even by accident. I see Libre cloud as a similar situation, though with more avenues for larger-scale abuse. Hopefully, just like with other things FOSS, the community will validate that everything is fine and the risk is minimal.

denton-scratch 5y ago
> At the end of the day, we largely trust canonical We speak for ourselves!

ineedasername 5y ago

Unless you're reading millions of LOC and compiling everything from source then you also have no guarantee there isn't a delta on any complex software you run. Guarantees are hard to come by. That's where reasonable amounts of risk assessment enter the picture. If you're looking for absolute certainty

3np 5y ago
If you shift the trust just one allegorical bit you don’t necessarily have to read all the code; just compare the sha256 hash with a known git commit and scan through the recent changes in the repo. Compiling from scratch isn’t necessarily such a big deal these days (guix/NixOS/gentoo for base system, locally built containers for orchestrated services). Personally I’m fine with putting some level of trust in the maintainers of Debian apt repos but everything else I definitely do take a look at where it’s coming from and what’s going on. There’s a middle ground between fine-combing the source tree and blindly accepting whatever comes from arbitrary upstreams.
- ineedasername 5y ago
  Ditto about Debian repos. But as for reading LOC's, comparing the hash won't help if a supply chain attack hit the code before it made it to a commit. I'm not actually advocate reading every LOC. I'm just saying that if you want to use just about anything, some level of trust has to be put in other people & other systems. It should always be a qualified trust though. a trust-but-verify (within reason).

croes 5y ago

Libre neither means secure nor trustworthy.

n3storm 5y ago

Their services are based on Nextcloud, Gitlab and Matrix, where you can export your data and move to another provider or self-hosted in no-time.

galaxyLogic 5y ago

What they could do since they have both a client and the server is make the client encrypt all content that is uploaded and decrypt it when downloaded by those who have a shared decryption key. Wouldn't that make sense?

grumbel 5y ago

Simple answer: It can't, since you don't own the server or the data on it. Long answer: It could be, if proper protocols and data structures would be employed that make it trivial to move the data off the server, mirror it or dual host it on multiple servers at once. So far there is however barely anything that does that, git for version control, IPFS for simple file hosting, but that's about it. The tools to build a "Libre Cloud" don't really exist (and federation is snake oil).

southerntofu 5y ago
> It could be, if proper protocols and data structures would be employed that make it trivial to move the data off the server I'm very interested in this domain. Hubzilla has pioneered account migration with the ZOT protocol, and there's discussions in the Jabber/XMPP ecosystem to implement something similar. Personally, i'm curious about going beyond a single protocol and migrating entire server services from a hosting coop to another: https://ttm.sh/dVy.md https://ttm.sh/dVy.md (draft blogpost) > The tools to build a "Libre Cloud" don't really exist (and federation is snake oil). There's Yunohost.org, Freedombox.org and Libreserver.org (ex FreedomBone). They're very cool, and enable non-tech users to selfhost. Why would you say the federation is snake oil?
- grumbel 5y ago
  > Why would you say the federation is snake oil? With federated services your are still just user@host, completely under the control of whoever owns host. Furthermore the federation aspect is completely optional, if host decides to blacklists some other hosts, there is nothing you can do about it. So I don't see the advantage over the Twitter, Facebook and Co., when everything that makes federation special can be taken away at any moment. Without some public-key crypto or something that allows you to move your identity to another server or better yet, never exist on any specific server to begin with, I just don't see the point. In general, I think the only way to build a "Libre Cloud" is by making the cloud part as stupid as possible. Have the actual app run completely on the client, use the cloud just as dumb object store with little to no awareness of what it is serving.