Qubes Debian templates have non-free/contrib (apt) by default

[fsflover]

It seems this discussion mixes two very different things making some replies unclear: FSF-endorsement (which you can reasonably call “ideological pureness”) and the free code license (the Wikipedia/community definition). The former is not achievable for Qubes, because of its security goals (as @adw explained quite well in the updated FAQ), whereas the latter applies to Qubes code, except the binary firmware necessary to use it on most hardware. There is no ideology in the latter definition. It’s just based on the type of license. You shouldn’t call a mix of free and non-free software “free software”, because it’s simply misleading and wrong, even if you have good intentions. Yes, it’s an amazing and costly achievement that Qubes is almost fully free software, and the Community, including me, values it very much. It’s why I am using and supporting it and spreading the word. But stretching definitions is not how you gain community respect. Debian rightfully call themselves “free operating system” on the main website. This is about the practical, license-based definition. Qubes currently is using “Debian non-official” without telling anyone. Fedora is not a free OS as a whole, and Wikipedia correctly doesn’t call it “free software”. Official Fedora website doesn’t call Fedora “free software” either:

Fedora creates an innovative, free, and open source platform for hardware, clouds, and containers that enables software developers and community members to build tailored solutions for their users.

@adw

@fsflover

Therefore, the question of how to determine whether a software is harmful (or, more precisely, how to determine whether the software has unreasonably higher likelihood of being harmful ) is not off-topic here.

That’s like saying, “It’s not off-topic, because it’s what I want to talk about.” Sure, I guess, but you’re the one who replied to me to begin with.

I fail to see how my personal opinion matters here. I remind that we are talking about absolutely unnecessary and potentially untrustworthy software in the official Qubes template, without clearly explaining it to the users.

@adw

(Btw, it’s not that Wikipedia has any special authority or is a “good source” or anything like that. It’s simply a reflection of the edits of a large number of internet users over time, which can be a handy way to get a sense of how certain terms are commonly used and understood.)

Wikipedia is not a source. It’s a list of (reliable and verifiable) sources, which reflects the accepted point of view in the society. It’s not a reflection of a large number of edits, unless the article is unfinished, or has edit wars. I think in this case the definition of free/open source software is pretty much settled, which is precisely reflected there.

@adw

It’s not just a definition. It’s a seal of approval. Even the FSF itself regards it as such. I think you already know that, and acting as though you don’t seems somewhat disingenuous.

I was talking about the licenses, not FSF-endorsement.

@adw

@fsflover

This would be honest unlike trying to change the settled definitions in the community.

Quote verbatim the allegedly dishonest thing I wrote and explain exactly how it’s dishonest. I’m waiting.

In the meantime:

@fsflover

Please avoid personal attacks.

I’m sorry that I was unclear. There was no personal attack here. I am not talking about you but about the text in the FAQ, which you are seemingly trying to defend:

Qubes is free and open-source software (FOSS).

See above why I think that it’s dishonest.

@adw

You didn’t say “proprietary software ”; you said “proprietary devices ”:

The articles you quoted don’t have word “proprietary” at all. What do you understand by “proprietary devices” anyway if not devices running and requiring proprietary software? Moreover, the context of this discussion is free software and how its freedoms help users. I’m sorry if I was unclear somewhere.

The articles do not mention how the lack of user rights leads to their powerlessness, they just say that the companies doing bad things are bad.

@fsflover

(Compare: all media constantly advertise proprietary devices showing their advantages and ignoring the dangers.)

What do you think about saying something along the following lines?

Qubes OS is a free OS, except the microcode, which is necessary to achieve security in modern hardware. The operating systems running inside Qubes OS by default (Fedora and Debian*) contain proprietary firmware required by most hardware today.

In other words, I suggest to remove the Fedora and Debian from the definition of Qubes OS. I guess I’m still running Qubes OS even if I replaced all templates with Trisquel. Am I right that nothing proprietary except the microcode exists in dom0?

*Having said that, I would like to repeat that I see no reason whatsoever to include proprietary firmware into Debian in the default Qubes configuration. Even if you believe that FLOSS doesn’t improve security (I’ll try to find some evidence otherwise), any unnecessary software increases the attack surface. It also breaks the expectations of regular Debian users who come to Qubes (like me) and goes against the Qubes FAQ about changing the distros. Manually changing the template for sys-net is an advanced feature, so I expect that such users should know how to add non-free repositories; and I am ready to help them do it, too. Choosing Debian as main template at install should give a warning that non-free repositories will be switched on to get the firmware, if needed.