Re: [GNU-linux-libre] DSFG in perpetuity

[Luke]

On 04/03/2018 04:40 PM, Isaac David wrote:
> I was about to say that, although worrisome, spyware capabilities
> have no impact in determining whether a piece of software belongs
> in a FSDG distro or not. Good thing I double-checked with the
> guidelines, because they actually do.
Yes, per: "The distro must contain no DRM, no back doors, and no spyware."
https://www.gnu.org/distros/free-system-distribution-guidelines.html
>
> Luke wrote :
>> [A]s of the date of the e-mail there
>> was still some freedom issues and plenty of links to Google.com which
>> could still be stripped out.
>>
>> List of good patches:
>> https://github.com/Eloston/ungoogled-chromium/tree/master/resources/patches
>>
>>
>> Compare to QTWebengine's (outdated) Chromium:
>> https://github.com/qt/qtwebengine-chromium
>
> This doesn't tell us much unfortunately.

The patches mention various places where Google API and pre-compiled
binaries are being removed, obviously QT is 4 years behind the latest
patches which makes it more difficult to do a 1:1 comparison.
I would say many of the issues are resolved due to their scrubbing.

>
>> - Debian freedom patches not applied, e.g. files missing licenses:
>> https://github.com/Eloston/ungoogled-chromium/blob/077e441e6654e4658de37c9d665e58f61b262961/resources/packaging/debian/buster/source/lintian-overrides
>>
>> https://github.com/qt/qtwebengine-chromium/blob/b45f07bfbe74c333f1017810c2409e1aa6077a1b/chromium/tools/trace/trace_data.js
>>
>
> What does that mean exactly? If I were to guess, lintian incorrectly
> confused trace_data.js for a blob, and ungoogled-chromium is reversing
> that overstep.

Yes, it was presumed to be a blob by Debian (and it is currently missing
license header)

>
>> - There may still be connections made to Google API.
>> https://github.com/qt/qtwebengine-chromium/search?p=2&q=%22www.googleapis.com%22&type=&utf8=%E2%9C%93
>>
>>
>> I'm just
>> not convinced they completely resolved it in their fork. So far
>> ungoogled-chromium is the only project I've compiled and ran with
>> Wireshark that did not have random connections to Google.com while the
>> browser is idling.
>
> By *the only project* do you mean you also tested with Qt
> Webengine-based programs? Conclusions about Chromium need
> not apply to Qt Webengine.
>
Of the projects I've tested: Ungoogled-chromium - no google connections
found presently, Inox - Leaks google account data on settings page
(fixed in recent commit)
I have not used QTWebengine in over a year and never ran a leak test. -
If someone has the time to do this and verify there are no freedom
issues, they can be removed from the conclusion as you mentioned.