2020 was a bad year at the end of a bad decade for software freedom. This post discusses how software rules everyone’s lives, how bad the situation is for software freedom, why software freedom matters, and explains why I believe that free software developers should direct their efforts toward emerging language ecosystems.
Over the past eighteen months, there have been incredible restrictions placed on people’s freedoms of movement, speech, and association. To have any social contact at all, many people have been restricted to online interactions as their only social outlet, almost exclusively through proprietary software.
In Australia, we are required by law to report our personal movements to one or more “contact-tracing” platforms, even to visit the supermarket or have something like a normal social life. This forces people to interact with an enormous pile of proprietary surveillance software just to participate in society. Despite earlier promises to only be used for contact tracing, these databases have been used by police (as always happens). It should be possible to build these check-in systems in a privacy-preserving way, and for the public to verify they have done so. A sketch: store location history on the device, upload to contact tracers only with the person’s consent and only in response to contact tracing queries. Unlink PII (used for contacting exposed people) from user IDs (used to build the graph of exposures) and store it separately. Free software then allows citizens at least some confidence that the software has in fact been built in a privacy-preserving way.
We live our lives at the mercy of software, and have been doing so well before the pandemic. Some non-COVID examples:
Inflexible automated systems make human compassion and discretion impossible.
The “Robodebt” fiasco applied nonexistent debts to welfare recipients, driving some to suicide.
“Smart home” devices in general. All software is haunted; a house that runs on software becomes a haunted house.
Being able to inspect, modify and run software on your own terms is valuable to everyone as a matter of public interest. The Free Software Foundation outlines four freedoms for a program to be considered “free software”:
These days, the FSF’s four freedoms are not enough to ensure software freedom for users:
Having the ability to see/change/build the source code to a program is no use if you cannot actually deploy and run that software:
The large body of BSD/MIT/X11-licenced software allows proprietary programs to be deployed on phones, consoles, and other locked-down devices. Now that locked-down computing is accepted by the public, this trend is creeping into PCs.
Software running on a server or “in the cloud” is never “distributed” or “conveyed” to users, bypassing the protections of all GPL-style licences except the Affero GPL.
The rise of software powered by machine learning models means that full source code can be useless, unless you have both the training data and enough computing power to re-train the models.
For years, privacy advocates have been saying “if it’s free, you’re the product”. These days, not even paying will protect you:
Windows gets a special dishonourable mention:
Windows 10 includes advertising all over the OS, even down to minesweeper. All the UI will let you do is turn off your “advertising ID”.
Windows nags users to try Microsoft’s Edge browser.
Windows has a bad habit of restarting to install “updates”, which are actually unwanted programs (or crappy games).
Windows isn’t the only offender of this type. Google recently installed a health notification app onto people’s phones without their knowledge or consent (HN, Google Play). You bought the phone, but everyone except you gets to run their code on it.
Even mouse drivers come with ads these days.
Have you tried to buy a non-“smart” TV recently? You pretty much can’t, and “smart” TVs have ads in their menu systems now, and who knows what data they exfiltrate? Low-priced TVs definitely make nearly as much money from ads and data as they do from selling the TV itself, and I’m sure that even premium models use spying as an additional revenue source.
The FSF’s proposed solution is to release software under copyleft
licences, so that user freedom is preserved as people share copyleft
software with each other. In the old old days, system software from the
GNU Project was a significant
improvement over the UNIX vendor’s proprietary software. The software
the GNU Project is most well-known for (system-level tools like coreutils)
has since been thoroughly commoditised, and people these days don’t
really say “I’d really love to use $AWESOME_LIBRARY; I’ll
copyleft my own software so that I can.”
I’d love to set out a clear and simple plan to liberate the world through the power of copyleft. Unfortunately, all I can offer are a few suggestions. The overall idea: make copyleft software more powerful and easier to contribute to, so that it becomes more attractive for users and developers.
The GCC Project recently relaxed its contributing requirements from “requires copyright assignment to the FSF”, to “provide Developer Certificate of Origin”. I am optimistic: the easier it is to contribute to copyleft projects, the more people will do it.
If you run a project and proceed on this path, I think it’s most future-proof to license individual contributors (and possibly the whole project) under the “or any later version”-style terms. This provides a mechanism to evolve the project licence without tracking down every single contributor each time you want to change.
If you publish a copyleft library in a crowded domain, people can flinch away and select an alternative. If you build something unique and different, people are more likely to pay the copyleft “price of entry” because the supply of alternatives is smaller.
Famous example in the other direction: libvorbis
switched from the LGPL
to a BSD-style licence with RMS’ approval, because the space of
sound libraries was already very crowded. Having libvorbis
under LGPL hurt the main goal — adoption of a non-patent-encumbered
audio codec — more than licensing via LGPL helped normalise
copyleft.
A more extreme version of point two: because there are relatively few copyleft developers compared to BSD/MIT/X11-licence FOSS developers, copyleft developers must be proportionally more powerful in order to stay competitive. Writing everything in C is no longer going to cut it; copyleft authors should be using the most powerful tools possible.
I think that if copyleft software wants to carve a niche for itself in 2021, emerging language ecosystems might be a good place to consider:
Emerging languages often aim to give developers more power, which fits the “most powerful tools” goal.
There are often fewer developers in an emerging language overall, which means that a copyleft project has more time to get established before a “BSD-licenced alternative” pops up to compete with it.
People working on a new niche may be happy just to “work on their thing” regardless of licensing. (Example: the FSF was offered the LLVM copyrights. Astonishingly, the offer slipped through the cracks.)
There are often large gaps in the libraries available for emerging languages. Contributing a JSON or XML library helps a lot of projects.
It could be interesting to see what happens to an emerging language with a high-quality copyleft-by-default ecosystem instead of a BSD/MIT/X11-licence-by-default ecosystem. Perhaps such an ecosystem could make copyleft developers more productive than non-copyleft open source developers, which could then make writing copyleft software more attractive.
Generalising point three: a single copyleft library is easily worked around. An ecosystem of copyleft libraries, all depending on each other? It becomes easier to copyleft than to reinvent the wheel and the axle and the transmission and the chassis…
Especially on unique software (point two), use licenses that provide stronger protections for users and developers. The AGPL is a start, but a critical mass of novel “or any later version” copyleft software could be used to enforce protections relating to machine learning, ensuring interoperability, or ensuring installability. The licences also need to evolve to defend against new attacks (such as locked bootloaders), but can only do so if there’s enough projects supporting those transitions.
I think that free software is vitally important to public society, and that copyleft software is still a useful way to ensure its continued existence. But that software needs to be more powerful for users and more attractive for developers, otherwise it will never reach critical mass. Instead, it will be routed around.