3 ms·

Using GPLv2-only licensing to prevent a GPLv3 project from taking our code while disallowing us from using their code (since we can't use GPLv3) is hardly anti-

by strcat 4y ago

Using GPLv2-only licensing to prevent a GPLv3 project from taking our code while disallowing us from using their code (since we can't use GPLv3) is hardly anti-FOSS. GrapheneOS can't use GPLv3 for Vanadium because it's incompatible with the WebView being loaded into other applications and GPLv3 has restrictions which would result in GrapheneOS being less free, by disallowing valid usage of GrapheneOS to make devices with an immutable root of trust. We want GrapheneOS to be friendly to people making downstream projects/products based on it and therefore stick to permissive licenses and GPLv2. GPLv2 is an open source license. We continued allowing them to take our code and continued contributing to their project ourselves despite the general inability to use Bromite's code. We already didn't find the situation to be fair. There are also issues with proper attribution not being given for our code and the downplaying of the impact of our contributions. For example, a contributor to Vanadium wrote a new ad-blocking implementation which was adopted by Bromite before it was ready for Vanadium, which led to a negative impact on development of the feature for Vanadium. Almost no credit is given for the stuff submitted by GrapheneOS project members / contributors to Bromite. It's actively downplayed. Bromite began working with people involved in a severe misinformation and harassment campaign directed at GrapheneOS developers. Combined with the inability to use their code due to GPLv3, we chose to change our licensing. This was done in advance of substantial work that's going to be done on Vanadium. Having our code taking by a project not giving us proper credit and not allowing us to use their work in return was having an actively negative effect on Vanadium development. Personally, I think engaging in spreading misinformation about open source projects across platforms including via sockpuppet accounts like this one along with harassment and libel targeting our project members is extremely anti-open-source. GrapheneOS does not spread misinformation about other projects this way, and we don't tolerate our community members doing it either, and similarly don't tolerate them engaging in harassment or libel.

strcat 4y ago
Separately from this, it's a misconception that CalyxOS and GrapheneOS are similar projects or that they're working on similar things. They are not. GrapheneOS is a hardened OS with substantial privacy and security improvements: https://grapheneos.org/features https://grapheneos.org/features CalyxOS is not a hardened OS. It substantially reduces security. It recently went 2 months not shipping standard security patches. Compatibility with Android apps on GrapheneOS is also much different. GrapheneOS provides our sandboxed Google Play compatibility layer: https://grapheneos.org/usage#sandboxed-google-play https://grapheneos.org/usage#sandboxed-google-play Can run the vast majority of Play Store apps on GrapheneOS, but not CalyxOS with the problematic microG approach. https://blog.privacyguides.org/2022/04/21/grapheneos-or-calyxos/ https://blog.privacyguides.org/2022/04/21/grapheneos-or-caly... is a 3rd party article explaining some of the substantial differences between GrapheneOS and CalyxOS. It's a common misconception that they're similar. CalyxOS is far more similar to LineageOS than GrapheneOS. There are many other alternate OSes available. https://privsec.dev/posts/android/choosing-your-android-based-operating-system/ https://privsec.dev/posts/android/choosing-your-android-base... is another article about privacy and security differences between alternative Android-based operating systems. Talks about other alternate operating systems including DivestOS. Unlike most content, these are based on real experience and technical details.
- jtode 4y ago
  This seems like a pretty good couple of answers to OP's question.
- throwaway_graph 4y ago
  I said that the goal of the projects is the same. It seems they're not equally effective in their efforts of reaching that goal, but that's besides the point.
  - strcat 4y ago
    The goals of the projects are not the same. CalyxOS is not a hardened OS and it doesn't aim to be a hardened OS. They don't work on the kinds of privacy and security features we do. For the most part, they work on much different things with very little overlap. Their approach is incompatible with ours. As an example, since they took over the Seedvault project and are running it in a similar way as their OS, it has blatant security issues. It uses privileged permissions it shouldn't and violates multiple aspects of the security model including bypassing app install rules. Encryption is not as opaque as it should be either. We aren't going to be able to use it anymore. We have to start over with a new backup service. Seedvault was originally written by a GrapheneOS community member for inclusion in GrapheneOS, based on the design that we laid out for it but it has deviated so far from that now and their goals / approach is incredibly incompatible with ours. Not even something like this can be shared. We had to drop F-Droid in 2018 because it has such huge security, usability, robustness and functionality issues. It still targeting Android 7 is the tip of the iceberg. It hasn't kept up with the platform at all and doesn't respect / follow the security model.
throwaway_graph 4y ago
Thanks for the response and the explanation. I was unaware of the licensing issues preventing GrapheneOS from taking code from Bromite despite Bromite taking from GrapheneOS, and of the lack of proper attribution for contributions from GrapheneOS. > Bromite began working with people involved in a severe misinformation and harassment campaign directed at GrapheneOS developers IMO "reviewing a pull request" is a far cry from "working with". You really expected Bromite to immediately close the PR, even if it contained valuable contributions, just because GrapheneOS claims (without evidence) that this person is associated with a group of harassers? > Personally, I think engaging in spreading misinformation about open source projects across platforms including via sockpuppet accounts like this one along with harassment and libel targeting our project members is extremely anti-open-source Baseless accusation. I'm not affiliated with any of these projects, but I do want the opportunity to contribute to them in the future, which is why I didn't post this using my main account. Also, it's not productive to view any form of criticism as "harassment and libel". Quoting from your GitHub comment: > anyone who contributes to Bromite going forward will be banned from the GrapheneOS community If merely contributing to Bromite can get you banned from the GrapheneOS community, we can reasonably assume that any criticism of such decisions can also get you banned, and I don't want that.
- strcat 4y ago
  > IMO "reviewing a pull request" is a far cry from "working with". You really expected Bromite to immediately close the PR, even if it contained valuable contributions, just because GrapheneOS claims (without evidence) that this person is associated with a group of harassers? They are doing much more than that, and we have ample evidence that these folks have engaged in libel and harassment. They also abused GitHub moderation tools to mislead people which is par for the course. It's you making claims without evidence... and it's very typical to be accusing us of what you folks are doing. Here's one of many examples of one of the people associated with Calyx doing exactly that in response to a purely technical post: https://twitter.com/DanielMicay/status/1547286521597894657 https://twitter.com/DanielMicay/status/1547286521597894657 There are many more examples including the leader of the organization doing this same routine of making up stories about me and claiming that I'm insane to direct bullying/harassment towards me. They've engaged in relentless libel and harassment for multiple years. > Baseless accusation. I'm not affiliated with any of these projects, but I do want the opportunity to contribute to them in the future, which is why I didn't post this using my main account. Also, it's not productive to view any form of criticism as "harassment and libel". You've done the opposite of contributing to any open source projects. You made at least one sockpuppet account to stir up shit on at least one platform to try to harm GrapheneOS. I wouldn't be surprised if other recent sockpuppet accounts belong to you too. You're demonstrating exactly why those projects and people involved in them are problematic. > and I don't want that. If you want to participate in the GrapheneOS project or community in good faith, you'll try to repair the harm you've caused. If you leave things like this, you aren't welcome.

by strcat 4y ago

strcat 4y ago

Separately from this, it's a misconception that CalyxOS and GrapheneOS are similar projects or that they're working on similar things. They are not. GrapheneOS is a hardened OS with substantial privacy and security improvements: https://grapheneos.org/features https://grapheneos.org/features CalyxOS is not a hardened OS. It substantially reduces security. It recently went 2 months not shipping standard security patches. Compatibility with Android apps on GrapheneOS is also much different. GrapheneOS provides our sandboxed Google Play compatibility layer: https://grapheneos.org/usage#sandboxed-google-play https://grapheneos.org/usage#sandboxed-google-play Can run the vast majority of Play Store apps on GrapheneOS, but not CalyxOS with the problematic microG approach. https://blog.privacyguides.org/2022/04/21/grapheneos-or-calyxos/ https://blog.privacyguides.org/2022/04/21/grapheneos-or-caly... is a 3rd party article explaining some of the substantial differences between GrapheneOS and CalyxOS. It's a common misconception that they're similar. CalyxOS is far more similar to LineageOS than GrapheneOS. There are many other alternate OSes available. https://privsec.dev/posts/android/choosing-your-android-based-operating-system/ https://privsec.dev/posts/android/choosing-your-android-base... is another article about privacy and security differences between alternative Android-based operating systems. Talks about other alternate operating systems including DivestOS. Unlike most content, these are based on real experience and technical details.

jtode 4y ago
This seems like a pretty good couple of answers to OP's question.
throwaway_graph 4y ago
I said that the goal of the projects is the same. It seems they're not equally effective in their efforts of reaching that goal, but that's besides the point.
- strcat 4y ago
  The goals of the projects are not the same. CalyxOS is not a hardened OS and it doesn't aim to be a hardened OS. They don't work on the kinds of privacy and security features we do. For the most part, they work on much different things with very little overlap. Their approach is incompatible with ours. As an example, since they took over the Seedvault project and are running it in a similar way as their OS, it has blatant security issues. It uses privileged permissions it shouldn't and violates multiple aspects of the security model including bypassing app install rules. Encryption is not as opaque as it should be either. We aren't going to be able to use it anymore. We have to start over with a new backup service. Seedvault was originally written by a GrapheneOS community member for inclusion in GrapheneOS, based on the design that we laid out for it but it has deviated so far from that now and their goals / approach is incredibly incompatible with ours. Not even something like this can be shared. We had to drop F-Droid in 2018 because it has such huge security, usability, robustness and functionality issues. It still targeting Android 7 is the tip of the iceberg. It hasn't kept up with the platform at all and doesn't respect / follow the security model.

throwaway_graph 4y ago

Thanks for the response and the explanation. I was unaware of the licensing issues preventing GrapheneOS from taking code from Bromite despite Bromite taking from GrapheneOS, and of the lack of proper attribution for contributions from GrapheneOS. > Bromite began working with people involved in a severe misinformation and harassment campaign directed at GrapheneOS developers IMO "reviewing a pull request" is a far cry from "working with". You really expected Bromite to immediately close the PR, even if it contained valuable contributions, just because GrapheneOS claims (without evidence) that this person is associated with a group of harassers? > Personally, I think engaging in spreading misinformation about open source projects across platforms including via sockpuppet accounts like this one along with harassment and libel targeting our project members is extremely anti-open-source Baseless accusation. I'm not affiliated with any of these projects, but I do want the opportunity to contribute to them in the future, which is why I didn't post this using my main account. Also, it's not productive to view any form of criticism as "harassment and libel". Quoting from your GitHub comment: > anyone who contributes to Bromite going forward will be banned from the GrapheneOS community If merely contributing to Bromite can get you banned from the GrapheneOS community, we can reasonably assume that any criticism of such decisions can also get you banned, and I don't want that.

strcat 4y ago
> IMO "reviewing a pull request" is a far cry from "working with". You really expected Bromite to immediately close the PR, even if it contained valuable contributions, just because GrapheneOS claims (without evidence) that this person is associated with a group of harassers? They are doing much more than that, and we have ample evidence that these folks have engaged in libel and harassment. They also abused GitHub moderation tools to mislead people which is par for the course. It's you making claims without evidence... and it's very typical to be accusing us of what you folks are doing. Here's one of many examples of one of the people associated with Calyx doing exactly that in response to a purely technical post: https://twitter.com/DanielMicay/status/1547286521597894657 https://twitter.com/DanielMicay/status/1547286521597894657 There are many more examples including the leader of the organization doing this same routine of making up stories about me and claiming that I'm insane to direct bullying/harassment towards me. They've engaged in relentless libel and harassment for multiple years. > Baseless accusation. I'm not affiliated with any of these projects, but I do want the opportunity to contribute to them in the future, which is why I didn't post this using my main account. Also, it's not productive to view any form of criticism as "harassment and libel". You've done the opposite of contributing to any open source projects. You made at least one sockpuppet account to stir up shit on at least one platform to try to harm GrapheneOS. I wouldn't be surprised if other recent sockpuppet accounts belong to you too. You're demonstrating exactly why those projects and people involved in them are problematic. > and I don't want that. If you want to participate in the GrapheneOS project or community in good faith, you'll try to repair the harm you've caused. If you leave things like this, you aren't welcome.