1 00:00:00,000 --> 00:00:04,930 [Talkmeister] Next, we will have zack presenting "Debian in the Dark Ages of Free Software" 2 00:00:08,690 --> 00:00:17,380 Can you hear me? 3 00:00:17,701 --> 00:00:18,420 Better. 4 00:00:18,570 --> 00:00:19,562 So, hello everyone. 5 00:00:19,683 --> 00:00:21,382 Welcome again to DebConf, I guess. 6 00:00:21,522 --> 00:00:25,360 It's a great pleasure to be back again at one DebConf 7 00:00:25,443 --> 00:00:28,447 and a great honor to be doing one of the opening talks. 8 00:00:29,161 --> 00:00:31,801 I confess I wasn't really expecting that honor. 9 00:00:31,870 --> 00:00:33,531 I just wanted to propose a session 10 00:00:33,559 --> 00:00:36,281 which was supposed to be a self held session 11 00:00:36,281 --> 00:00:39,326 for those of us that think there are some worries 12 00:00:39,520 --> 00:00:43,320 about where the free software is going in general. 13 00:00:43,763 --> 00:00:47,651 And the role that distributions have to play in the current state of affairs. 14 00:00:48,004 --> 00:00:50,925 So this talk will be about a couple of journeys at once. 15 00:00:51,216 --> 00:00:54,286 The first journey is a journey through emotions, 16 00:00:54,569 --> 00:00:58,640 through good feelings about what we have achieved in Free Software 17 00:00:58,921 --> 00:01:01,800 over the past 15 to 20 or 30 years 18 00:01:01,824 --> 00:01:03,860 depending on how long you've been involved. 19 00:01:04,006 --> 00:01:06,284 The second journey is essentially my own journey 20 00:01:06,284 --> 00:01:08,122 through software freedom 21 00:01:08,132 --> 00:01:10,840 from the day I started discovering Free Software 22 00:01:10,866 --> 00:01:13,240 and what I've ended up doing since then. 23 00:01:14,282 --> 00:01:17,240 Starting with the positive news. 24 00:01:17,640 --> 00:01:23,001 This is how I got involved myself in free software in 1997. 25 00:01:23,050 --> 00:01:25,140 I understand that there are people in the room 26 00:01:25,161 --> 00:01:27,920 who have been involved since way earlier than that, 27 00:01:27,949 --> 00:01:30,360 others that have been involved since way later than that. 28 00:01:30,450 --> 00:01:31,561 Well, that's my story. 29 00:01:32,046 --> 00:01:34,802 I hope you'll find ??? points with your own story. 30 00:01:35,560 --> 00:01:41,041 When I started as a freshman in a computer science class at university of Bologna, 31 00:01:41,360 --> 00:01:43,600 that was a huge tiping point, 32 00:01:43,845 --> 00:01:47,121 a huge hype point for the so-called opensource movement. 33 00:01:47,560 --> 00:01:52,040 That was the year the very influencial essay by Eric Raymond has been published. 34 00:01:52,404 --> 00:01:58,528 That was the year that Netscape decided to opensource its own code. 35 00:01:58,870 --> 00:02:01,210 That was the moment in the history of free software 36 00:02:01,320 --> 00:02:04,000 when people were trying to sell to the industry 37 00:02:04,280 --> 00:02:09,431 what free software was doing, and I'm not using that word in a bad sense. 38 00:02:09,610 --> 00:02:12,970 There was reasonable concern that without involvement of the industry, 39 00:02:13,000 --> 00:02:16,400 the free software movement wouldn't have got far. 40 00:02:16,773 --> 00:02:21,830 So they were trying to tell about free software in an industry-friendly way. 41 00:02:22,283 --> 00:02:25,203 Essentially, the rhetoric at the point was that 42 00:02:25,475 --> 00:02:28,800 if you do development of software in the free software way, 43 00:02:28,960 --> 00:02:31,230 in a more open way, a more participative way, 44 00:02:31,360 --> 00:02:35,693 you will end up having better software and that by merely opening up you code 45 00:02:35,896 --> 00:02:40,526 you'll have these flocks of programmers coming to you project and end up helping you. 46 00:02:41,600 --> 00:02:47,046 A few years later, I realised that I personally didn't believe much in that idea: 47 00:02:47,261 --> 00:02:50,390 it's only because your software is open that it's gonna be better, 48 00:02:50,727 --> 00:02:53,521 but it was a fair thing to try at the time. 49 00:02:54,282 --> 00:02:57,304 What I discovered a bit later is actually what stuck in me 50 00:02:57,304 --> 00:03:00,336 was essentially the philosophy of free software. 51 00:03:00,336 --> 00:03:05,360 The fact that computer user should be in charge and in control of their own machine, 52 00:03:05,480 --> 00:03:07,200 that should have some basic freedom. 53 00:03:07,241 --> 00:03:10,770 You know about the 4 freedoms, I'm not going to repeat them here, 54 00:03:11,067 --> 00:03:15,922 but my personal point is that the narrative of free software is something 55 00:03:15,960 --> 00:03:17,890 that resonated with me a lot at the time. 56 00:03:18,201 --> 00:03:21,334 As a student, I realised that by having free software at my fingertip 57 00:03:21,334 --> 00:03:22,847 as a computer science student, 58 00:03:22,847 --> 00:03:25,898 I could debug any single layer of the software stack 59 00:03:25,898 --> 00:03:27,699 and look at how things are going. 60 00:03:27,699 --> 00:03:32,000 I didn't have to trust the teacher on how an operating system should be developed. 61 00:03:32,121 --> 00:03:36,314 I was able to open up sched.c in the linux kernel and have a look 62 00:03:36,314 --> 00:03:41,440 at the actual scheduling algorithm that was being implemented in the real kernel. 63 00:03:41,489 --> 00:03:43,555 Not that I really got all of it at the time 64 00:03:43,555 --> 00:03:46,781 but the possibility was just breathtaking for me. 65 00:03:47,911 --> 00:03:52,982 Later on, I ended up distilling the main intuition of free software, 66 00:03:52,982 --> 00:03:55,980 which is the one I used to explain free software to people, 67 00:03:55,980 --> 00:03:57,600 which is intuition of control. 68 00:03:57,832 --> 00:04:03,303 So, I ended up believing that the main reason why I've been involved in this movement 69 00:04:03,362 --> 00:04:07,750 for about fifteen years is that I really believe that every single computer user, 70 00:04:08,013 --> 00:04:10,249 and that's a lot of people these days, 71 00:04:10,249 --> 00:04:13,755 should be in control over their own computations. 72 00:04:13,755 --> 00:04:17,212 Everything you're doing with a device which is mediated via software 73 00:04:17,440 --> 00:04:20,840 is controled by someone, either it is you or it is someone else. 74 00:04:21,539 --> 00:04:24,350 And the best episode, the best narrative to explain that to people 75 00:04:24,391 --> 00:04:26,794 that they've been using for quite a while is this passage 76 00:04:26,794 --> 00:04:29,197 from the novel "Makers" by Cory Doctorow 77 00:04:29,197 --> 00:04:31,600 which is a bit long so I'm not gonna read it in detail, 78 00:04:31,752 --> 00:04:35,518 but essentially there is one character of the novel which is Lester 79 00:04:35,760 --> 00:04:39,580 which is explaining to another character the importance of controling 80 00:04:39,580 --> 00:04:41,370 your own devices, your own tools. 81 00:04:41,370 --> 00:04:44,170 The first example he takes is the example of a hammer, 82 00:04:44,170 --> 00:04:45,840 a physical hammer, 83 00:04:45,840 --> 00:04:48,570 and he goes on saying that if you own a hammer, 84 00:04:48,750 --> 00:04:50,940 essentially you could do whatever you want with it. 85 00:04:50,980 --> 00:04:53,303 You can use it for its main purpose, 86 00:04:53,303 --> 00:04:55,426 or you can use it for something completely different 87 00:04:55,426 --> 00:04:58,520 which was not meant to be its original purpose but it's you that decide. 88 00:04:58,952 --> 00:05:03,886 He compares that another device which is the "Disney in a box" in the novel 89 00:05:04,155 --> 00:05:08,487 and Disney in this book is the big evil villain which is oppressing people 90 00:05:08,770 --> 00:05:14,271 and essentially Disney in a box is a glorified 3D printer that can only print 91 00:05:15,131 --> 00:05:17,960 what Disney wants it to print for that day. 92 00:05:18,632 --> 00:05:22,071 One day, it will print a Goofy character, 93 00:05:22,071 --> 00:05:24,600 another day it will print Donald Duck, 94 00:05:24,600 --> 00:05:26,160 but it's not you who decides. 95 00:05:26,217 --> 00:05:30,227 It's Disney that decides what the printer is gonna print for you that day. 96 00:05:30,560 --> 00:05:33,968 You own the device but you are not in control of what the device does. 97 00:05:35,080 --> 00:05:38,831 The big quote for me is that if you don't control your life, you're miserable. 98 00:05:39,560 --> 00:05:45,920 This notion of oppression is what has been motivating me for all these years. 99 00:05:46,160 --> 00:05:49,864 So the fact that if you are not in control of your own computation, 100 00:05:49,864 --> 00:05:52,088 then someone is oppressing you. 101 00:05:52,088 --> 00:05:56,552 Someone usually is the person or the company or whatever that has created the software, 102 00:05:56,588 --> 00:05:59,210 that has the power to change that software instead of you. 103 00:05:59,640 --> 00:06:01,413 This is something that really ??? in me. 104 00:06:02,711 --> 00:06:05,440 What was I doing at the time with my computer? 105 00:06:05,440 --> 00:06:08,049 Well I was doing pretty standard stuff. 106 00:06:08,049 --> 00:06:10,596 I was using some hardware we had at the time 107 00:06:10,596 --> 00:06:14,063 which was mostly desktops and local network servers. 108 00:06:14,063 --> 00:06:16,668 I didn't have a laptop because it was really expensive for a student 109 00:06:16,668 --> 00:06:19,003 so I did get a laptop much later. 110 00:06:19,003 --> 00:06:21,930 I was doing some content production, some content consumption. 111 00:06:21,983 --> 00:06:24,836 The kind of content I did produce at the time was mostly 112 00:06:24,836 --> 00:06:29,139 office suites, desktop publishing and this kind of stuffs. 113 00:06:29,139 --> 00:06:32,352 I was doing some communication, some email, some IRC, some newsgroup 114 00:06:32,352 --> 00:06:34,705 which was really cool at the time for geek communities. 115 00:06:34,705 --> 00:06:36,946 And I was doing some software development as a newbie 116 00:06:36,946 --> 00:06:38,987 but it was what I was doing at the time. 117 00:06:38,987 --> 00:06:41,941 I also did some content consumption, some gaming 118 00:06:41,941 --> 00:06:45,855 which are arguably some content that someone else is producing for you to consume. 119 00:06:46,075 --> 00:06:47,361 I was doing some web browsing. 120 00:06:47,461 --> 00:06:49,147 Internet was not as popular as it is today, 121 00:06:49,147 --> 00:06:52,743 but there were some websites you could find interesting. 122 00:06:54,163 --> 00:06:57,195 In that situation, with this kind of computing, 123 00:06:57,565 --> 00:07:02,507 the actual path to software freedom and to control was fairly clear. 124 00:07:02,817 --> 00:07:07,911 It was difficult, but it was fairly clear to me as a new activist in free software. 125 00:07:08,057 --> 00:07:11,674 What I should have done, what we all should have done to actually liberate people 126 00:07:11,674 --> 00:07:14,541 from the oppression of people controling our own computation. 127 00:07:15,031 --> 00:07:18,948 The idea is that while you have a lot of pieces of proprietary software 128 00:07:18,948 --> 00:07:22,883 which you do not control, what you need to do is to replace 129 00:07:22,883 --> 00:07:28,198 every such a component of proprietary software with a free software equivalent. 130 00:07:28,658 --> 00:07:31,626 Using some local application, some game, 131 00:07:31,626 --> 00:07:34,054 we need to replace it with an equivalent free game. 132 00:07:34,054 --> 00:07:39,156 We were using some client-server software, some mail ???, some mail client, 133 00:07:39,156 --> 00:07:42,218 some mail server, some IRC client, some IRC server. 134 00:07:42,218 --> 00:07:47,395 What we needed to do to actually empower people and liberate people was to rewrite 135 00:07:47,395 --> 00:07:50,862 those pieces of software with free software equivalents. 136 00:07:50,942 --> 00:07:55,360 It was difficult, because it was a lot of stuff to be rewritten, but it was fairly clear. 137 00:07:55,599 --> 00:07:56,561 The plan was clear. 138 00:07:56,842 --> 00:08:01,560 And also, luckily, we also had, at the time, all the heavy lifting was already in place. 139 00:08:01,880 --> 00:08:04,570 The GNU project existed since quite a while, 140 00:08:04,570 --> 00:08:07,460 the Linux kernel existed already and it was working. 141 00:08:07,460 --> 00:08:11,963 So someone else with shoulders larger than I had at the time 142 00:08:11,963 --> 00:08:15,252 had already done a lot of work for me and me 143 00:08:15,252 --> 00:08:19,458 and together with other free software activists, what I had to focus on was to rewrite 144 00:08:19,458 --> 00:08:24,294 proprietary application into equivalent free software application, possibly better. 145 00:08:24,514 --> 00:08:27,480 That was clear, was hard, but it was fairly clear. 146 00:08:29,001 --> 00:08:34,570 That's where, I think, the notion of a free software project comes from. 147 00:08:34,813 --> 00:08:39,955 We use very often this term of free software project and I never ended up 148 00:08:39,955 --> 00:08:44,323 really thinking about that before a few years ago and I think the reason why 149 00:08:44,323 --> 00:08:46,881 we call it free software project is that there is an objective. 150 00:08:46,881 --> 00:08:49,914 So there is a mission, ideally a time-limited one, 151 00:08:49,914 --> 00:08:54,916 and that mission is writing a replacement for a proprietary application using 152 00:08:54,916 --> 00:08:58,568 free software which is as good, possibly better than the original. 153 00:08:59,338 --> 00:09:03,612 Having a lot of free software projects around gives rise to a lot of releases. 154 00:09:03,960 --> 00:09:06,656 So what we were doing a lot at the time in the 90s 155 00:09:06,656 --> 00:09:10,092 was to actually manually install software on our own machines. 156 00:09:10,092 --> 00:09:14,679 To be fair, our lab was running some Red Hat machines. 157 00:09:14,679 --> 00:09:18,107 At the time there weren't that many packages available and 158 00:09:18,107 --> 00:09:21,895 we had to fairly often install stuff by hand on the lab machines 159 00:09:21,895 --> 00:09:25,033 in our own directories and also on our computers at home. 160 00:09:25,033 --> 00:09:27,633 This is a procedure you all know very well. 161 00:09:27,933 --> 00:09:31,693 You download a tarball, you run "configure", you run "make", you run "make install". 162 00:09:32,000 --> 00:09:35,529 The first time I saw that, it was kind of a magical recipe for me. 163 00:09:35,720 --> 00:09:38,402 Just follow these steps and you will get some software to play with. 164 00:09:38,672 --> 00:09:41,890 Well, except that every single step could fail, of course. 165 00:09:42,200 --> 00:09:47,023 Let's keep aside for the moment the fact that the website might be down but, 166 00:09:47,023 --> 00:09:50,726 you run "configure" and you miss some software you need to fetch from somewhere else. 167 00:09:50,726 --> 00:09:54,480 You run "make", you encounter some compilation problem. 168 00:09:54,791 --> 00:09:58,428 You run "make install", maybe the path will clash and so on and so forth. 169 00:09:58,658 --> 00:10:03,160 The problem with this procedure for installing software we are using by hand 170 00:10:03,880 --> 00:10:05,801 is that you are essentially conflicting roles. 171 00:10:06,600 --> 00:10:09,800 You're mixing together the role of software user, 172 00:10:10,201 --> 00:10:13,480 the role of system administrator and the role of software developper. 173 00:10:14,080 --> 00:10:19,240 You need to have a little bit of all those skills together to be able to enjoy software. 174 00:10:20,000 --> 00:10:24,760 In a sense, a free software which works like this is essentially a very elistist thing. 175 00:10:25,160 --> 00:10:29,241 It's only an elite which have all the needed skills who is able to enjoy 176 00:10:29,560 --> 00:10:34,440 the benefits of free software and is able to be in control of their own computation. 177 00:10:35,080 --> 00:10:39,240 This is essentially the reason why distributions much earlier had been invented. 178 00:10:39,720 --> 00:10:42,960 We all know very well here what distributions do, 179 00:10:43,320 --> 00:10:48,204 they sit in between software developpers and software users and make it easy for you 180 00:10:48,681 --> 00:10:50,040 to actually use that software. 181 00:10:50,480 --> 00:10:55,600 We do installer work, we create installers, we create package managers, 182 00:10:55,752 --> 00:11:00,040 we do all the integration work that make different pieces of software work well together. 183 00:11:00,480 --> 00:11:04,560 We actually make life easy for final users. 184 00:11:05,480 --> 00:11:11,395 So, for me, something that I started believing is that the ultimate mission of free software 185 00:11:11,395 --> 00:11:16,521 distributions is to actually democratize free software, to enable users 186 00:11:16,720 --> 00:11:21,361 which do not have software development skills or do not have system administration skills, 187 00:11:21,640 --> 00:11:24,547 enable them to enjoy the benefit of free software. 188 00:11:24,960 --> 00:11:27,320 We offer very simple interface, 189 00:11:27,640 --> 00:11:31,601 we offer the equivalent of what these days are called appstores in which 190 00:11:31,760 --> 00:11:34,640 with one click, you can just install some software and 191 00:11:34,800 --> 00:11:38,084 enjoy the benefit of that software, in particular a free software. 192 00:11:39,760 --> 00:11:43,320 This is for me the historical mission of distributions. 193 00:11:44,440 --> 00:11:49,244 Later on, in 1998, our lab decided to switch to Debian 194 00:11:49,750 --> 00:11:51,440 and I was really happy about that. 195 00:11:51,961 --> 00:11:54,120 We switch from Red Hat to Debian and I look out about this project, 196 00:11:54,120 --> 00:11:58,430 I start learning what this project does and I find out that not only 197 00:11:58,770 --> 00:12:03,020 this project Debian was actually up to the mission of empowering user 198 00:12:03,020 --> 00:12:06,480 by making it easy for users to use free software. 199 00:12:06,980 --> 00:12:12,242 If you read the original announcement of Ian Murdock announcing the Debian project, 200 00:12:12,242 --> 00:12:15,880 we'll find this notion of being competitive with proprietary operating systems 201 00:12:16,160 --> 00:12:18,720 and it's really clear that the point is empowering users. 202 00:12:19,403 --> 00:12:24,560 I end up reading about this project and not only I found out that their mission 203 00:12:24,887 --> 00:12:28,480 they're up to is the mission I believe in, but I found out that the key intuition there 204 00:12:28,760 --> 00:12:30,720 is to make the project a community project. 205 00:12:31,230 --> 00:12:34,121 Not only the target are the users and empowering them, 206 00:12:34,280 --> 00:12:37,840 but also the way to reach that objective is creating, fostering a community 207 00:12:38,120 --> 00:12:40,000 that will work together to that goal. 208 00:12:40,440 --> 00:12:41,760 I got immediately hooked, 209 00:12:41,927 --> 00:12:44,521 I vividly remember the moment a collegue of mine, a student 210 00:12:44,680 --> 00:12:47,441 explained to me the anatomy of a Debian source package, 211 00:12:47,760 --> 00:12:51,120 the fact that it was a .orig.tar.gz, the fact that it was a diff.gz 212 00:12:51,150 --> 00:12:53,881 with the differences with respect to upstream, and all those metadata 213 00:12:53,881 --> 00:12:56,481 that was really thrilling for me from a technical point of view. 214 00:12:57,000 --> 00:13:00,841 A few years later, I ended up joining the nm-process. 215 00:13:01,369 --> 00:13:05,480 I was doing some OCaml development at the time, there were some libraries, 216 00:13:05,521 --> 00:13:08,200 OCaml libraries in Debian, others were missing and I said 217 00:13:08,440 --> 00:13:12,960 "Ok, maybe I should help and create some libraries for the project as well". 218 00:13:13,240 --> 00:13:20,239 I went through nm and there are a few things I've learned doing nm 219 00:13:20,280 --> 00:13:23,360 and also in the subsequent ten years or fifteen years or so. 220 00:13:23,840 --> 00:13:29,720 One thing I've learned in all these years in Debian is the importance of being principled. 221 00:13:30,520 --> 00:13:34,761 Debian is a project that did not start from only technical means 222 00:13:35,280 --> 00:13:37,680 but also decided at some point that they needed some guidance, 223 00:13:37,720 --> 00:13:40,400 some clear guidance of what it should do technically and what it shouldn't. 224 00:13:41,240 --> 00:13:45,920 And an important document where we have distilled this notion are the DFSG. 225 00:13:46,602 --> 00:13:47,960 The Debian Free Software Guidance 226 00:13:48,161 --> 00:13:50,961 which has been very influencial on the free software movement as a whole. 227 00:13:51,320 --> 00:13:54,280 They've been used as a base for the open source definition as you know, 228 00:13:54,761 --> 00:13:58,240 and what was very thrilling for me is that commitment we had in Debian 229 00:13:58,521 --> 00:14:03,057 in keeping the main archive completely DFSG-free, keeping it completely free software. 230 00:14:03,601 --> 00:14:08,167 This commitment is depicted here by those fearsome character 231 00:14:08,668 --> 00:14:14,400 and his owner on a couch and it's mediating and triggering the NEW queue, supposedly, 232 00:14:14,801 --> 00:14:17,479 and the NEW queue is not necessarily the best way we could implement 233 00:14:17,837 --> 00:14:21,641 a system which triage all the software in the archive and to ensure it's DFSG-free 234 00:14:21,760 --> 00:14:27,320 but it shows our commitment to actually only follow the guidance we have set for ourselves. 235 00:14:27,600 --> 00:14:29,480 It was really motivating for me. 236 00:14:29,760 --> 00:14:32,121 The second thing I've learned and which will come handy in a bit, 237 00:14:32,121 --> 00:14:37,240 is the importance of the legal knowledge and legal geeks in the free software movement. 238 00:14:37,440 --> 00:14:42,910 Like it or not, free software as an ideal is philosophical mean, 239 00:14:42,910 --> 00:14:48,082 but its main implementation is through the legal system, is through copyright licenses. 240 00:14:48,561 --> 00:14:52,280 To really grok what's happening in free software in general, 241 00:14:52,280 --> 00:14:55,840 to understand where the free software movement is going, figuring out and 242 00:14:55,840 --> 00:14:59,321 really understand what's going on in the legal system is very important. 243 00:15:00,200 --> 00:15:03,920 In Debian, we know that pretty well, that's a stumbling block for many people 244 00:15:04,061 --> 00:15:06,120 when joining the Debian project. 245 00:15:06,120 --> 00:15:09,960 It's something we insist people are at least basically familiar with and 246 00:15:09,960 --> 00:15:14,280 that's pretty characteristic of the Debian project. 247 00:15:14,520 --> 00:15:17,040 In the end, what I've learned is that 248 00:15:17,840 --> 00:15:22,660 in this quest that I feel very much myself against the oppression of someone else 249 00:15:22,660 --> 00:15:27,361 controling your own computation, law, if you hack around it smartly, 250 00:15:27,361 --> 00:15:31,723 can be a very useful ally, a very useful device to liberate users. 251 00:15:33,400 --> 00:15:38,480 Time passes − there was supposed to be an image here, which for some reason disappeared. 252 00:15:38,960 --> 00:15:45,040 And, we might argue that, these days, we have achieved a lot since that moment. 253 00:15:45,520 --> 00:15:48,922 If I look around the industry or, in general, if I look around computing 254 00:15:49,240 --> 00:15:54,000 as people are doing that, free software is a little bit everywhere. 255 00:15:54,680 --> 00:15:58,400 In the industry, there are some stats that claim that essentially 256 00:15:58,640 --> 00:16:02,320 every single software product you find on the market has, inside of it, 257 00:16:02,480 --> 00:16:04,600 a little bit of free software code. 258 00:16:05,536 --> 00:16:08,280 If you look at all the different application stacks we have 259 00:16:08,642 --> 00:16:11,280 from webservers to education to clients to smartphones, 260 00:16:11,602 --> 00:16:15,800 you find a lot of free software, free software infrastructures that are everywhere. 261 00:16:16,400 --> 00:16:19,400 So these are just some stats I figure out in the recent years 262 00:16:19,880 --> 00:16:24,600 and for instance if we look at one of the key target market for Debian ??? 263 00:16:24,960 --> 00:16:30,441 we'll find out one website over ten on the Internet in general is running Debian. 264 00:16:30,720 --> 00:16:33,800 If we include also some of our most popular derivatives such as Ubuntu, 265 00:16:34,121 --> 00:16:35,960 we'll find that more than 20% of the websites 266 00:16:36,240 --> 00:16:38,560 are running something which comes from our own work. 267 00:16:39,001 --> 00:16:45,721 And some of the recent hype on free software is coming from the Snowden revelation 268 00:16:45,721 --> 00:16:50,000 and most people are starting to be concerned about what the software they're using is doing 269 00:16:50,400 --> 00:16:55,680 and is turning to free software and is turning to stuff like Tails which is heavily Debian-based 270 00:16:55,680 --> 00:17:00,685 to actually see in which way we can help them foster their own security. 271 00:17:01,281 --> 00:17:03,000 In some sense, we have achieved a lot. 272 00:17:03,680 --> 00:17:08,041 In everything we do in computing, there is a little bit of what we have done 273 00:17:08,041 --> 00:17:10,800 in free software and also a little bit of what we have done in Debian. 274 00:17:11,160 --> 00:17:12,960 This is pretty impressive for me. 275 00:17:13,040 --> 00:17:18,560 We're in a place where I wouldn't have dreamed being when I started in 1997. 276 00:17:18,874 --> 00:17:19,881 That's very impressive. 277 00:17:20,321 --> 00:17:24,160 On the other hand, there are some reasons of concerns 278 00:17:24,480 --> 00:17:27,951 and this is the main thought I wanted to share with you. 279 00:17:30,020 --> 00:17:33,880 There are some technical reasons which we discuss often in free software circles 280 00:17:34,240 --> 00:17:40,040 like the fact that "Ok but most of these platforms are not 100% free software". 281 00:17:40,841 --> 00:17:42,560 If you look at smartphones for instance, 282 00:17:42,760 --> 00:17:48,440 you will find a lot of non free code every here and there and the point can be made that 283 00:17:48,440 --> 00:17:52,041 either you have full control over your own computation, 284 00:17:52,200 --> 00:17:53,440 or you are not in control at all, 285 00:17:53,600 --> 00:17:57,206 because if your software stack has a single layer which is controlled by someone else, 286 00:17:57,206 --> 00:18:01,200 and is mediating all your communication, maybe you're not so sure 287 00:18:01,524 --> 00:18:04,600 that you are the real owner and the real controller for your own device. 288 00:18:04,760 --> 00:18:07,157 That's a absolutely fair point. 289 00:18:07,160 --> 00:18:11,241 We can make some more technical points about for instance non free JavaScript. 290 00:18:11,321 --> 00:18:14,520 More and more of our computations are happening in our browsers 291 00:18:14,855 --> 00:18:17,680 and are happening through code which is delivered to our browser 292 00:18:17,680 --> 00:18:21,081 by remote servers and this code is not free at all. 293 00:18:21,160 --> 00:18:26,840 I absolutely agree with that but the point I want to focus on today is actually 294 00:18:27,040 --> 00:18:29,561 what we call the cloud. 295 00:18:30,080 --> 00:18:33,012 All my images are gone. 296 00:18:34,160 --> 00:18:36,040 You had a very nice image there, sorry. 297 00:18:41,390 --> 00:18:45,525 The remaining point and my main reason of concern is what is being called the cloud. 298 00:18:45,961 --> 00:18:48,640 Let allow me to be a bit generic here for a moment. 299 00:18:49,040 --> 00:18:51,360 I know there are very different parts in what we call the cloud 300 00:18:51,720 --> 00:18:53,800 and will be specific in all of them in a bit. 301 00:18:54,320 --> 00:18:56,680 But for now I want to focus on the common trend that 302 00:18:56,720 --> 00:18:58,880 the cloud is bringing to computing these days. 303 00:18:59,481 --> 00:19:03,897 Computing today, for most people, is not much different from the kind of computing 304 00:19:03,960 --> 00:19:05,962 I was doing fifteen years ago. 305 00:19:07,240 --> 00:19:09,960 That's the kind of computing that we do on very different hardware, 306 00:19:10,120 --> 00:19:13,920 we have way more smartphones, way more tablets than in the past and that's true. 307 00:19:14,320 --> 00:19:19,160 But the kind of activities we do − producing content, consuming content − is very similar. 308 00:19:19,720 --> 00:19:23,721 The big difference is the kind of technological stack we're using 309 00:19:24,040 --> 00:19:25,880 and where the computations are happening. 310 00:19:26,280 --> 00:19:30,440 For most people today, the kind of office suites we use is no longer 311 00:19:30,640 --> 00:19:33,687 a software which is installed on your machine but it is Google Docs. 312 00:19:34,000 --> 00:19:39,200 I'm an academic myself, I'm very often forced to use some Google Docs applications 313 00:19:39,281 --> 00:19:42,160 to work with others, otherwise I'm free not to work with them, 314 00:19:42,640 --> 00:19:45,881 because it's a technological choice made by someone else. 315 00:19:46,320 --> 00:19:49,240 For many people, e-mail, as you know, just means GMail. 316 00:19:49,480 --> 00:19:52,960 All our e-mails, even if your not using GMail ourselves, 317 00:19:53,288 --> 00:19:55,480 are passing through some GMail servers. 318 00:19:55,681 --> 00:20:00,080 Asynchronous communications still exist, but it is very often mediated 319 00:20:00,200 --> 00:20:01,640 to software like Skype or GTalk. 320 00:20:02,000 --> 00:20:02,940 And so on and so forth. 321 00:20:02,940 --> 00:20:04,240 You have seen this list very often. 322 00:20:04,920 --> 00:20:08,640 Consuming content, there as well, we are still doing gaming, 323 00:20:08,640 --> 00:20:11,400 we are still doing browsing but it's often mediated by platforms 324 00:20:11,520 --> 00:20:14,320 which are far away from us and just stream content to us or, 325 00:20:14,480 --> 00:20:19,320 in the specific case of web browsing, they are more and more often hosted 326 00:20:19,320 --> 00:20:23,120 by very few hosters in the world − which we often refer to a walled garden − 327 00:20:23,240 --> 00:20:25,644 that can do whatever they want with our content. 328 00:20:27,040 --> 00:20:30,720 The point here is not demonizing those services. 329 00:20:30,960 --> 00:20:35,307 People are using those services because they are convenient and 330 00:20:35,560 --> 00:20:39,525 there is a lot of network effect going on that makes it easy for other people 331 00:20:39,601 --> 00:20:41,360 to start using those services. 332 00:20:41,720 --> 00:20:44,200 It's really not the point of demonizing those services. 333 00:20:44,200 --> 00:20:49,444 The point here is observing that interesting computations that we are doing 334 00:20:49,720 --> 00:20:53,200 as our job, as our life, 335 00:20:53,320 --> 00:20:57,241 are no longer happening on our machines, but are happening on other machines 336 00:20:57,390 --> 00:21:02,400 which are far away from us and which are not under our direct control. 337 00:21:02,641 --> 00:21:09,200 In this context, for me, I confess, what actually is the road to software freedom 338 00:21:09,200 --> 00:21:12,040 and to control, to enable people to control their own computation 339 00:21:12,120 --> 00:21:13,080 is no longer clear. 340 00:21:13,400 --> 00:21:17,080 It's no longer enough to say "Well, we just need to rewrite 341 00:21:17,200 --> 00:21:20,383 Google or Facebook or Twitter in free software". 342 00:21:20,440 --> 00:21:23,961 That's not enough, because even if you do that, you have the problem 343 00:21:23,961 --> 00:21:27,401 that when you are using a server you don't know if the code it is running 344 00:21:27,521 --> 00:21:31,658 is the one they claim it is running, so that's a very difficult problem to solve. 345 00:21:31,880 --> 00:21:35,320 And even if it were the case, where do you deploy yourself 346 00:21:35,600 --> 00:21:38,521 a Google-like architecture, or a Facebook-like architecture? 347 00:21:38,800 --> 00:21:40,000 You simply can't. 348 00:21:40,400 --> 00:21:42,371 It is no longer enough to just say 349 00:21:42,521 --> 00:21:45,200 "We just need to do some software development, 350 00:21:45,320 --> 00:21:47,802 we just need to make it better than the alternative." 351 00:21:48,201 --> 00:21:51,600 There is a real tricky combination between software development 352 00:21:51,819 --> 00:21:55,881 and software deployment which not easy to see how to fix it. 353 00:21:56,380 --> 00:21:59,520 At least for me, it's very ??? 354 00:21:59,620 --> 00:22:01,043 So, what about distros? 355 00:22:02,139 --> 00:22:06,280 We are distro people, doing one of the most popular distros in existence. 356 00:22:06,320 --> 00:22:09,248 Are we winning or are we losing in this situation? 357 00:22:09,400 --> 00:22:13,165 How are we doing in terms of our efforts? 358 00:22:14,074 --> 00:22:16,320 In a sense, we are very much winning. 359 00:22:17,521 --> 00:22:20,800 A lot of our work is being used to deploy those infrastructures. 360 00:22:21,320 --> 00:22:24,080 A lot of the infrastructure of the big companies are deploying 361 00:22:24,200 --> 00:22:27,560 on top of free software, if not direct on top of our very own systems, 362 00:22:27,640 --> 00:22:31,560 maybe modified here and there where they need to make things better 363 00:22:31,560 --> 00:22:34,680 as it is their own right given it's all free software. 364 00:22:35,400 --> 00:22:36,680 In that sense, we're winning. 365 00:22:37,137 --> 00:22:38,480 We're increasing market share, 366 00:22:38,642 --> 00:22:40,920 ??? are being used a lot to make infrastructure. 367 00:22:41,400 --> 00:22:46,240 But we are also losing in the sense that we are really not empowering users 368 00:22:46,240 --> 00:22:48,560 to be in control of their own computations. 369 00:22:49,000 --> 00:22:53,401 If our final users are the sysadmin that are running those infrastructures, 370 00:22:53,720 --> 00:22:55,202 for them we are doing great. 371 00:22:55,360 --> 00:22:56,920 We are making them be sure 372 00:22:56,920 --> 00:22:59,041 they are in control of their own infrastructure. 373 00:22:59,320 --> 00:23:01,640 But for the final users of those services, 374 00:23:01,960 --> 00:23:04,562 we are really not empowering them at the moment. 375 00:23:05,080 --> 00:23:07,241 So what I call the free software dark ages, 376 00:23:07,280 --> 00:23:13,241 which is an expression I actually borrowed from Bradley Kuhn and I find it quite inspiring, 377 00:23:13,520 --> 00:23:17,760 is a situation in which we win on the end user market 378 00:23:17,760 --> 00:23:21,681 so every single device out there in the hand of people − desktop, 379 00:23:21,681 --> 00:23:26,000 laptop, even smartphones where right now we are not doing very well − 380 00:23:26,160 --> 00:23:28,360 all of this is running free software. 381 00:23:28,440 --> 00:23:29,720 All of that is running Debian. 382 00:23:30,080 --> 00:23:34,600 So, total world domination as we were talking about a long time ago. 383 00:23:34,760 --> 00:23:39,080 But all interesting computations, all the final user application 384 00:23:39,201 --> 00:23:42,920 which is being used to bring on with your digital life, 385 00:23:43,160 --> 00:23:46,801 are no longer happening on your devices, happening far away from you 386 00:23:47,040 --> 00:23:50,363 on computer you do not control, sometime with free software, 387 00:23:50,363 --> 00:23:51,655 sometime with non free software. 388 00:23:52,001 --> 00:23:54,126 But in any case, outside of your own control. 389 00:23:54,440 --> 00:23:58,493 In a sense, this is very worrysome for me because we have this euphoria of saying 390 00:23:58,493 --> 00:24:00,166 we are very popular. 391 00:24:00,246 --> 00:24:06,600 We are winning the war − we were using a lot of this war-like terminology when I started. 392 00:24:06,600 --> 00:24:11,680 But the war we are winning seems to become increasingly pointless 393 00:24:12,080 --> 00:24:15,522 because it's not being useful to actually empower users to be in control 394 00:24:15,800 --> 00:24:17,240 of their own computation. 395 00:24:18,401 --> 00:24:23,601 To make things worse, there seems to be some cultural problems that might be 396 00:24:23,601 --> 00:24:28,441 just a perception of mind, maybe I'm being too pessimistic, but it seems to me that, 397 00:24:28,441 --> 00:24:31,520 as developper communities, as hacker communities, 398 00:24:31,640 --> 00:24:34,440 we are becoming way more lenient, way more lax 399 00:24:34,960 --> 00:24:38,281 about the lack of control on the tools and on infrastructure we use 400 00:24:38,600 --> 00:24:39,760 to make free software. 401 00:24:40,280 --> 00:24:43,880 More and more often we see free software developed on non-free infrastructure, 402 00:24:43,880 --> 00:24:47,280 meaning infrastructures which are built using non-free software 403 00:24:47,360 --> 00:24:50,600 and which are anyhow centralized in the hand of a few hosters. 404 00:24:53,670 --> 00:24:55,640 The new generation of developpers which is coming up 405 00:24:55,720 --> 00:24:57,080 seems to be totally fine with that. 406 00:24:57,320 --> 00:25:00,520 I'm not gonna argue this point in much detail, there is a great essay by Mako 407 00:25:00,880 --> 00:25:03,880 that I encourage all of you to read, "Free software needs free tools", 408 00:25:04,200 --> 00:25:05,840 which actually make couple of points. 409 00:25:05,881 --> 00:25:09,360 One is that by using non-free software to make free software, 410 00:25:09,360 --> 00:25:11,081 we are sending out a very bad message. 411 00:25:11,160 --> 00:25:13,814 We are telling to the world that free software is good for you, 412 00:25:13,814 --> 00:25:16,480 that's why we are developing it, but it's not good for us 413 00:25:16,561 --> 00:25:18,480 because we are using non-free tools to make it. 414 00:25:18,801 --> 00:25:21,841 That's the kind of "catch 22" in our advertising message, 415 00:25:21,920 --> 00:25:26,120 but it's also making the software we are creating indirectly less free, 416 00:25:26,401 --> 00:25:29,880 because if the favorite way to contribute to that free software 417 00:25:29,961 --> 00:25:32,200 is using some non free infrastructure, some non free tools, 418 00:25:32,320 --> 00:25:35,840 indirectly we're making people that only want to use free software 419 00:25:36,040 --> 00:25:38,600 less apt to contribute to that software. 420 00:25:38,920 --> 00:25:41,241 So I really recommend reading that essay. 421 00:25:41,560 --> 00:25:44,800 But also technically, we are going back to a sort of a cage problem, 422 00:25:44,920 --> 00:25:49,640 which is also a problem which is called "the problem of the bug that noone can fix" 423 00:25:49,680 --> 00:25:53,640 by the FSF I think, and essentially we're creating software stacks 424 00:25:53,680 --> 00:25:57,400 in which some part of it is entirely free software, that we can debug 425 00:25:57,481 --> 00:26:02,320 and some other parts are non free software or software run by someone else, 426 00:26:02,600 --> 00:26:05,160 so we have lost the ability to debug the full stack. 427 00:26:05,960 --> 00:26:11,000 When I was starting to learn programming, this idea that I could debug everything 428 00:26:11,280 --> 00:26:14,801 from the end user I was writing myself for an assignment 429 00:26:14,920 --> 00:26:17,709 down to the kernel level was just exciting for me. 430 00:26:18,040 --> 00:26:20,520 We seem to be losing sight of this, a little bit. 431 00:26:21,800 --> 00:26:25,360 As a second cultural problem, we seem to be losing sight of 432 00:26:25,720 --> 00:26:29,160 how much help we could get from the legal system 433 00:26:29,492 --> 00:26:32,720 and from new legal solution that we might be in need of finding. 434 00:26:33,041 --> 00:26:38,361 An example of that is the post open source software "POSS" debate 435 00:26:38,640 --> 00:26:40,720 which some of you might have run into. 436 00:26:41,000 --> 00:26:43,920 That's a debate which actually observes that the new generation of 437 00:26:44,160 --> 00:26:48,008 free software developpers actually don't care about licenses. 438 00:26:48,523 --> 00:26:51,363 They just want to kick out their code, just put it on GitHub, 439 00:26:51,643 --> 00:26:54,963 not declaring their license at all and they're just fine with that. 440 00:26:55,363 --> 00:27:00,883 They want to be ??? to have the hassle of deciding first of all a license, 441 00:27:01,208 --> 00:27:04,403 second of all also some governance model for their projects. 442 00:27:04,483 --> 00:27:09,163 They just want to be hacking and doing, and not caring about those annoying details. 443 00:27:10,163 --> 00:27:15,523 This could be intervetedly interpreted in positive ways like says that 444 00:27:15,763 --> 00:27:22,523 we want the right to work on the code and to do whatever we want with that by default. 445 00:27:22,763 --> 00:27:25,483 We do not want to be expliciting which kind of rights we give and 446 00:27:25,643 --> 00:27:27,603 that's a very positive interpretation of this phenomenon. 447 00:27:28,043 --> 00:27:32,083 But in the end, for now, it is creating a huge bunch of code that 448 00:27:32,123 --> 00:27:35,243 we could not use as free software yet. 449 00:27:35,443 --> 00:27:38,643 For instance we cannot include in Debian something that does not have a license at all. 450 00:27:39,523 --> 00:27:43,043 A second example is the debate about the non-freeness of AGPL. 451 00:27:43,723 --> 00:27:49,923 If you look up the history of free software, there is argument that GPL itself is not free. 452 00:27:50,003 --> 00:27:52,723 It's an argument that was being used twenty years ago 453 00:27:52,763 --> 00:27:56,963 when the battle between copyleft and liberalizing was very high, was very harsh. 454 00:27:57,403 --> 00:27:59,402 And it's just recurring again. 455 00:27:59,843 --> 00:28:04,123 So maybe for some syntactically interpretation of our own guidance, 456 00:28:04,163 --> 00:28:08,123 we could make the point that something like the AGPL is non-free, maybe. 457 00:28:08,603 --> 00:28:12,883 But the point is that the way we distribute software to final users is really changing. 458 00:28:13,443 --> 00:28:18,123 Twenty years ago or fifteen years ago, the main way to enable some user to use 459 00:28:18,363 --> 00:28:21,283 a piece of software was actually to make a copy of that software and 460 00:28:21,283 --> 00:28:25,163 give it to him or to her via the network or some media. 461 00:28:25,563 --> 00:28:29,163 And all those conveying, that kind of conveying software is clearly 462 00:28:29,163 --> 00:28:34,483 distribution and that kind of activity used to trigger some sort of license clauses. 463 00:28:34,723 --> 00:28:38,443 These days, a software is no longer distributed that way, in large parts. 464 00:28:38,729 --> 00:28:44,683 It's being used over the net and something like the AGPL is the equivalent of triggering 465 00:28:44,803 --> 00:28:48,203 some licensing condition via the main way of distributing, 466 00:28:48,243 --> 00:28:50,123 of giving access to some software. 467 00:28:50,603 --> 00:28:53,453 I want to enter in details in this debate. 468 00:28:53,493 --> 00:28:56,283 Those are just examples, for me they are examples of the fact that 469 00:28:56,283 --> 00:29:01,163 we are kind of losing faith in how much the legal system and free software 470 00:29:01,203 --> 00:29:02,403 are intertwined. 471 00:29:02,922 --> 00:29:06,435 And this actually mixes very badly with the situation in which 472 00:29:06,435 --> 00:29:10,324 users are losing control because those computations are moving away from them. 473 00:29:10,683 --> 00:29:14,243 I think this situation, in general, is not going to fix themselves 474 00:29:14,608 --> 00:29:18,403 and we, as distribution people, have a role to play in fixing it. 475 00:29:19,723 --> 00:29:25,563 What could be a role for Debian in all this computing situation we have these days. 476 00:29:27,813 --> 00:29:31,883 The common trend in the so called cloud seems to be that computations 477 00:29:31,925 --> 00:29:33,844 are moving away from user devices. 478 00:29:34,643 --> 00:29:37,763 We cannot just say "Well just don't use anything cloudy", 479 00:29:38,043 --> 00:29:40,083 because it is convenient, people will want to use that. 480 00:29:40,243 --> 00:29:41,563 We need to do something different. 481 00:29:41,921 --> 00:29:46,291 As distribution people, we could do a lot, I think, and I have a couple of thoughts 482 00:29:46,564 --> 00:29:53,683 to share with you that are different depending on the so called service model 483 00:29:53,683 --> 00:29:54,643 of the cloud. 484 00:29:54,803 --> 00:29:57,521 One of the first service model of the cloud you might have heard about is 485 00:29:57,685 --> 00:30:00,643 "Infrastructure as a Service" (IaaS) where essentially you have servers that 486 00:30:00,849 --> 00:30:05,643 give virtual machines to people and essentially you get to administer 487 00:30:05,763 --> 00:30:08,403 your own machine which is a virtual machine on a virtual machine server 488 00:30:08,683 --> 00:30:10,206 controlled by someone else. 489 00:30:10,444 --> 00:30:14,243 This is potentially very good for people because it is lowering the barrier 490 00:30:14,284 --> 00:30:16,323 you need to have your own server. 491 00:30:16,643 --> 00:30:21,083 When I first set up my own server with friends, at the end of the 90's, 492 00:30:21,324 --> 00:30:24,883 we had to buy some machine, to find someone kind enough to host it, 493 00:30:25,003 --> 00:30:27,523 pay the hosting fees and so on and so forth. 494 00:30:27,723 --> 00:30:31,963 It was something that was by far not at all accessible to the random user. 495 00:30:32,323 --> 00:30:37,045 These days, a lot of people can simply go to some virtual machine provider, rent 496 00:30:37,283 --> 00:30:42,044 a virtual machine with one-click button and they have their own machine to administer. 497 00:30:42,364 --> 00:30:46,164 Maybe they don't have the skill to administer it, that's a different problem, 498 00:30:46,332 --> 00:30:50,403 but you are definitely lowering the barrier to access, to have you own server 499 00:30:50,682 --> 00:30:52,563 and do your own remote computation. 500 00:30:53,083 --> 00:30:56,363 As Debian, we are doing pretty well in this area, I think. 501 00:30:56,483 --> 00:31:00,206 We're offering technology like OpenStack and other competitors of OpenStack, 502 00:31:00,403 --> 00:31:04,603 which seems to be the market leader on that market which are entirely free software. 503 00:31:04,884 --> 00:31:09,963 But I think we should be investing more in offering a trivial deployment experience 504 00:31:10,211 --> 00:31:11,364 for Debian users. 505 00:31:11,403 --> 00:31:15,765 We should make trivial for people to have their own virtual machine servers. 506 00:31:15,765 --> 00:31:19,203 If they are not computer geeks, they should be able to flock together friends 507 00:31:19,443 --> 00:31:25,523 which have system administration ability and have their own local IaaS 508 00:31:25,723 --> 00:31:30,843 and have their own virtual machine without having to rely on big hosters provided 509 00:31:30,923 --> 00:31:33,043 virtual machines to everyone in the world. 510 00:31:33,444 --> 00:31:36,523 This is a great step to our autonomy. 511 00:31:36,603 --> 00:31:40,683 As Debian, what is the best deployment experience we can offer for people 512 00:31:40,724 --> 00:31:43,323 that want to setup their own virtual machine servers. 513 00:31:44,163 --> 00:31:48,124 Then, there is another service model which is called PaaS, "Platform as a Service". 514 00:31:48,163 --> 00:31:51,724 This is a kind of service model in which essentially you have hosters 515 00:31:51,724 --> 00:31:55,724 of application engines, you develop application targeting 516 00:31:55,724 --> 00:31:58,723 specific application engine. 517 00:31:59,273 --> 00:32:02,462 Sorry, application servers. You target specific application servers. 518 00:32:02,462 --> 00:32:04,813 An exemple of this is Google App Engine. 519 00:32:05,683 --> 00:32:11,003 I think in some sense this service model of the cloud is mostly orthogonal to 520 00:32:11,003 --> 00:32:15,123 what we do as a distribution because either you're using a full fledge distribution 521 00:32:15,363 --> 00:32:19,243 and you do your own system administration, or you are developping an application 522 00:32:19,363 --> 00:32:22,403 for a specific application server and you rely on someone else 523 00:32:22,403 --> 00:32:23,963 to do that administration. 524 00:32:24,323 --> 00:32:28,003 So, yes, I think it's mostly orthogonal to what we do, but might also be 525 00:32:28,117 --> 00:32:31,810 a symptom that there is a reject from the application developper community, 526 00:32:31,883 --> 00:32:36,723 a reject from the way they can target distributions like Debian. 527 00:32:37,123 --> 00:32:40,523 So if it is very difficult to have your own application running properly on Debian 528 00:32:40,803 --> 00:32:45,523 because we have old software, because we change libraries, because we do not accept 529 00:32:45,802 --> 00:32:48,483 multiple copies of the same libraries and so on and so forth, 530 00:32:48,683 --> 00:32:51,364 if it is too difficult for application developpers to target Debian, 531 00:32:51,729 --> 00:32:57,363 they might be more and more tempted to target applications servers like PaaS. 532 00:32:57,763 --> 00:33:02,363 So there might be something we could do about this, here, like finding better synergies 533 00:33:02,763 --> 00:33:06,443 between containerization technology, we have some work being done in Debian, 534 00:33:06,443 --> 00:33:12,251 and the way we usually develop some, we usually maintain a distribution. 535 00:33:12,251 --> 00:33:14,403 There might be something we could do about this here. 536 00:33:14,733 --> 00:33:18,881 Oh, and I didn't mention this, but I have no specific answer to give to you, 537 00:33:18,923 --> 00:33:22,683 just a train of thoughts I wanted to share with you and what we could do 538 00:33:22,723 --> 00:33:23,963 to improve the situation. 539 00:33:25,244 --> 00:33:29,563 The final service model we have in the cloud, which is I think worrysome 540 00:33:29,563 --> 00:33:34,723 from the point of view of user control, is SaaS, "Software as a Service". 541 00:33:35,043 --> 00:33:39,283 There, essentially your own device, your own computer only is thin client 542 00:33:39,664 --> 00:33:43,563 and rely entirely on a remote server to do your own computation. 543 00:33:43,843 --> 00:33:48,208 We are back to the mainframe / thin client distinction of the early days of computing 544 00:33:48,563 --> 00:33:52,963 and here, there is a lot we could do, I think, but also a lot we could not do. 545 00:33:53,290 --> 00:33:55,963 Here, most of the work should come from upstreams. 546 00:33:56,283 --> 00:33:59,883 We need better free software and federated replacement for 547 00:34:00,003 --> 00:34:05,043 popular centralized proprietary applications in which users can participate 548 00:34:05,203 --> 00:34:07,843 in some kind of network by using their own node. 549 00:34:08,203 --> 00:34:12,763 This is work that should not come from distribution itself, it should really come 550 00:34:12,763 --> 00:34:14,843 from application developpers upstream. 551 00:34:15,203 --> 00:34:18,083 But still, there are useful things we could do here. 552 00:34:18,643 --> 00:34:21,083 We already have a lot of building blocks. 553 00:34:21,523 --> 00:34:26,883 We have stuff like Owncloud, Git-annex, mediagoblin, pump.io, Yacy. 554 00:34:26,963 --> 00:34:31,123 We have a lot of good building blocks, most of them are not yet up to par 555 00:34:31,203 --> 00:34:36,243 with the centralized proprietary equivalent, but I'm confident we could get there. 556 00:34:36,604 --> 00:34:42,883 What we lack is the equivalent ease of deployment of these services on user machines. 557 00:34:43,385 --> 00:34:50,003 In some sense, if we have democratized the installation of software twenty years ago 558 00:34:50,203 --> 00:34:56,643 with distributions, these days, to face the challenge of control of our own computation, 559 00:34:56,883 --> 00:35:00,723 we need to make it as easy as using a package manager to install 560 00:35:01,003 --> 00:35:04,043 your own nodes using those applications. 561 00:35:04,443 --> 00:35:12,483 Ideally, everyone in the world without nothing more than basic computer user skills 562 00:35:12,763 --> 00:35:17,323 should be able to have its own machine at home doing some anonymous browsing, 563 00:35:17,563 --> 00:35:21,363 doing some mail handling, doing web hosting, doing storage calendar, 564 00:35:21,563 --> 00:35:24,323 doing encrypted peer to peer backup, and so and so forth. 565 00:35:24,723 --> 00:35:28,923 I'm maintaining my own mail server and it is a user ???, I struggle myself 566 00:35:29,243 --> 00:35:33,443 to keep up with the need of knowledge and of surveillance that I need to make 567 00:35:33,523 --> 00:35:39,203 to my own mail server to be able to run it properly and I get blacklisted 568 00:35:39,243 --> 00:35:41,562 from time to time from providers and it's a pain. 569 00:35:41,923 --> 00:35:47,091 Something that no one without having at least some basic system administration ability 570 00:35:47,091 --> 00:35:48,723 could do properly. 571 00:35:49,043 --> 00:35:51,843 This is the thing we need, the nut we need to crack. 572 00:35:52,163 --> 00:35:55,963 We need to empower everyone out there to have its own computer with 573 00:35:56,003 --> 00:35:58,243 its own node of those services. 574 00:35:58,323 --> 00:36:00,483 Of course, you are all thinking of the FreedomBox now. 575 00:36:00,843 --> 00:36:06,363 That's a great example of a project who wants to tackle precisely that problem. 576 00:36:06,803 --> 00:36:11,003 It's a project that's been announced by Eben Moglen a few years ago at a Debconf 577 00:36:11,083 --> 00:36:12,683 if my memory serves me well. 578 00:36:13,043 --> 00:36:17,443 It's heavily based on Debian and it's doing exactly that. 579 00:36:18,283 --> 00:36:21,523 But my question from the Debian point of view is: 580 00:36:21,603 --> 00:36:25,123 maybe this project should not only be a spin-off of Debian, 581 00:36:25,283 --> 00:36:29,723 should not only be a derivative distribution of Debian, 582 00:36:29,848 --> 00:36:33,883 maybe we should think at making something like this a first class citizen in Debian. 583 00:36:34,243 --> 00:36:38,603 I don't know exactly what that means yet, it's something we could think about 584 00:36:38,603 --> 00:36:41,328 having the main administration interface for Debian something 585 00:36:41,363 --> 00:36:43,203 that targets these specific scenarios. 586 00:36:43,203 --> 00:36:47,843 We could generalize that, we do not need to target only specific plug devices 587 00:36:48,243 --> 00:36:51,603 because people at home might have desktop computers, might have media center. 588 00:36:51,763 --> 00:36:55,924 They might want something like the FreedomBox at home and 589 00:36:55,963 --> 00:36:57,523 collaborate with others immediately. 590 00:36:57,963 --> 00:37:02,443 My point here is that if our mission back in the days was to 591 00:37:02,683 --> 00:37:06,843 democratize free software by making it easier to install software 592 00:37:06,949 --> 00:37:10,483 on your machine, today our mission is to democratize free software by making it 593 00:37:10,483 --> 00:37:15,815 trivial to install some node of some federation of free services on your machine. 594 00:37:18,243 --> 00:37:20,963 Another thing we could do, it is the last one for me today, 595 00:37:21,323 --> 00:37:23,882 is to step in the free service debate. 596 00:37:24,323 --> 00:37:28,244 When I started looking up these arguments a few years back, I was surprised by 597 00:37:28,244 --> 00:37:33,323 the fact that it's still not clear what it does mean to be a free service. 598 00:37:34,723 --> 00:37:37,243 When I started working on free software fifteen years ago, 599 00:37:37,403 --> 00:37:39,735 it was fairly clear what does free software mean. 600 00:37:39,923 --> 00:37:43,483 Sure, it was some terminology debate between free software and open source 601 00:37:43,523 --> 00:37:44,643 which still exists today, 602 00:37:44,926 --> 00:37:48,443 but the basic freedoms, the basic rights you should have to call something 603 00:37:48,511 --> 00:37:51,083 free and open source was fairly clear. 604 00:37:51,443 --> 00:37:54,643 That kind of intellectual debate had already happened at the time. 605 00:37:54,963 --> 00:37:59,490 Today, where the problem of computations moving away from indivual user 606 00:37:59,770 --> 00:38:02,643 is raging, there is no clear consensus on that matter. 607 00:38:03,083 --> 00:38:07,603 There is some great work, for instance there is the Franklin Street statement on 608 00:38:07,603 --> 00:38:10,445 free network service, I think that's a full ???, 609 00:38:10,643 --> 00:38:16,283 dating back to 2008, six years ago, in which you find a lot of very useful 610 00:38:16,763 --> 00:38:21,963 recommendations for users, for software developpers and for system administrators 611 00:38:22,043 --> 00:38:27,364 to make sure that you maximize your control over your own computation on the network, 612 00:38:27,563 --> 00:38:32,483 but they take no stance on what it does mean to be a free service. 613 00:38:33,603 --> 00:38:37,883 Is it enough to have something which is free, do you need more specific license. 614 00:38:37,964 --> 00:38:40,883 There are some recommendation on that point, but still, 615 00:38:41,123 --> 00:38:42,923 there are no clear answers to this question. 616 00:38:45,083 --> 00:38:50,803 There is another work by RMS in 2010 about Software as a Service or 617 00:38:51,123 --> 00:38:53,163 "service as a software substitute" as he calls it. 618 00:38:53,483 --> 00:38:57,333 Here, essentially what you have is a main recommandation about 619 00:38:57,403 --> 00:39:00,844 not using Software as a Service at all. 620 00:39:01,363 --> 00:39:04,724 Essentially there is a recommandation of doing your own computation 621 00:39:04,763 --> 00:39:06,243 on your own machines. 622 00:39:06,684 --> 00:39:11,203 I think that might be a generally good recommandation but it's not gonna scale, 623 00:39:11,646 --> 00:39:14,483 it's not gonna be enough in my opinion to convince people 624 00:39:14,525 --> 00:39:16,603 not to use very convenient services. 625 00:39:16,923 --> 00:39:21,123 Think we need more gradual and blurry lines saying, encouraging people 626 00:39:21,271 --> 00:39:25,644 to keep computation closer to them, to rely on federation of friends of people 627 00:39:25,843 --> 00:39:27,484 to do computation together. 628 00:39:27,563 --> 00:39:31,371 And we, as distribution people, could make easier for them to do so. 629 00:39:31,883 --> 00:39:36,323 And then there is another work which is "Network Services Aren't Free or Nonfree" 630 00:39:36,763 --> 00:39:40,723 which is a couple of years later, still by RMS, which essentially tries to walk the fine line 631 00:39:40,963 --> 00:39:44,083 between what's the difference between a pure service, so a service that 632 00:39:44,203 --> 00:39:47,643 just for instance convey messages, as opposed to a service which does 633 00:39:47,643 --> 00:39:51,363 computation that could have been done instead on your machine. 634 00:39:51,523 --> 00:39:55,724 That's a very fine line to work, it's very difficult to stay there and 635 00:39:55,724 --> 00:40:01,049 what we might need there is a strong opposition, actually, and we should try 636 00:40:01,291 --> 00:40:05,203 to replace everything which is centralized with federated equivalent and say that 637 00:40:05,203 --> 00:40:08,945 we as free software people and distribution people should work in that direction. 638 00:40:09,963 --> 00:40:11,284 So what we could do in Debian. 639 00:40:11,284 --> 00:40:13,611 Well, I think we should try to step in this debate. 640 00:40:13,875 --> 00:40:20,283 Surprisingly for me, we still have no clear answer to what it means to be a free service 641 00:40:20,283 --> 00:40:24,283 today and we have quite a bit of experience in Debian 642 00:40:24,323 --> 00:40:27,203 in leading debates in free sotfware. 643 00:40:27,203 --> 00:40:29,764 We have created the DFSG which is being used as an example for 644 00:40:29,964 --> 00:40:34,123 many other communities, we have participated in the GPLv3 discussion for instance. 645 00:40:34,283 --> 00:40:39,124 Our decisions in terms of free license are looked up by other projects. 646 00:40:39,363 --> 00:40:43,003 So we might have the authority and the reputation to step in this debate 647 00:40:43,211 --> 00:40:46,569 and we also have a lot of technical knowledge in the area. 648 00:40:47,043 --> 00:40:52,803 Being a distribution commited to free software, we know a thing or two not only about 649 00:40:53,043 --> 00:40:58,763 software freedom, but also about how you deploy software, how difficult it is 650 00:40:58,763 --> 00:41:01,524 and how difficult it should be for people to deploy free software. 651 00:41:01,843 --> 00:41:06,083 So I think we are in just the sweet spot to actually enter this debate 652 00:41:06,523 --> 00:41:10,604 with the needed authority and make a contribution to actually help people 653 00:41:10,803 --> 00:41:13,566 realize what it means today to use a free service. 654 00:41:14,963 --> 00:41:16,283 The concluding question I have for you is 655 00:41:16,523 --> 00:41:21,324 "What's Debian take today on liberating users?". 656 00:41:21,763 --> 00:41:26,384 Would we be happy enough to have Debian on every machine in the world 657 00:41:26,565 --> 00:41:29,324 if people are using completely remote services? 658 00:41:29,684 --> 00:41:33,763 And if we were not, what should we do, what should we be working on to change 659 00:41:34,003 --> 00:41:37,963 that future which seems very much the future that we have at hand. 660 00:41:39,524 --> 00:41:47,083 Pictures are gone, so there was a cloud on the left, 661 00:41:47,643 --> 00:41:50,204 there was Debian here and a sun here. 662 00:41:50,523 --> 00:41:54,364 LaTeX, beamer or Tikz or something is playing tricks on me. 663 00:41:55,004 --> 00:41:58,683 So that's all I have for you, I hope I've given you some food for thoughts 664 00:41:58,924 --> 00:42:03,324 for this week and if you have any question or comments in these topics, 665 00:42:03,523 --> 00:42:05,084 I'm very much happy to hear about that. 666 00:42:05,604 --> 00:42:06,483 Thank's a lot. 667 00:42:06,643 --> 00:42:15,563 [applause] 668 00:42:23,123 --> 00:42:25,923 There seems to be a mic which is floating around down there. 669 00:42:43,564 --> 00:42:49,963 [Q] ??? quite a lot and quite brilliantly about what cloud computing buzzwords 670 00:42:50,203 --> 00:42:57,603 mean for free software, but I think what important battle we are actually losing is ??? 671 00:42:57,687 --> 00:42:58,723 in the minds of people. 672 00:42:58,924 --> 00:43:02,243 [Q] Why is it young developpers or newcommers to free software 673 00:43:02,484 --> 00:43:05,603 don't care about software being free? 674 00:43:07,043 --> 00:43:11,603 [Q] Why don't they care about using non free tools, why don't they care about 675 00:43:11,843 --> 00:43:17,683 which license declare for their software if any license is at all? and so on. 676 00:43:18,043 --> 00:43:22,883 [Q] You mention that problem, but what do we do about it? Do you have any ideas? 677 00:43:25,403 --> 00:43:28,843 [Zack] Well, a friend of mine we asked a similar question I think once answered 678 00:43:29,283 --> 00:43:32,003 "What could they say more that 'Oh those young kids' ". 679 00:43:32,803 --> 00:43:37,123 So, I don't know, maybe it's our fault, maybe we have failed as a generation 680 00:43:37,163 --> 00:43:40,883 to convey the importance that being in control of our own computation had, 681 00:43:41,164 --> 00:43:45,923 or maybe it's just that the public that is open to coding and 682 00:43:45,923 --> 00:43:49,643 hacking is much larger than in the past so we are reaching out other communities. 683 00:43:50,331 --> 00:43:54,523 It's very good for them to be coding because I think every citizen in the world need 684 00:43:54,523 --> 00:43:58,283 to have basic knowledge of coding to understand what's happening in the world, 685 00:43:58,643 --> 00:44:02,363 but maybe they just have different mission than we had in the past. 686 00:44:04,969 --> 00:44:07,403 So, very good question, I don't have a very good answer, sorry. 687 00:44:10,803 --> 00:44:11,923 [Q] Hello. 688 00:44:17,513 --> 00:44:22,044 Thank you so much for the wonderful talk, I think it's great to talk about these 689 00:44:22,284 --> 00:44:29,403 political issues and I see there's a challenge between the sort of very individual focus 690 00:44:29,563 --> 00:44:34,166 of each person being able to use their own computer as the wish which has its own values, 691 00:44:35,003 --> 00:44:39,603 but there's a different sort of value that relates to power structures in general. 692 00:44:40,003 --> 00:44:46,163 So, we're talking about not just how free is each individual person but whether 693 00:44:46,483 --> 00:44:50,567 an entity like Twitter, Google or Facebook or some these other services 694 00:44:50,603 --> 00:44:57,164 is a very powerful entity that has power over the majority of us who use their services. 695 00:44:57,884 --> 00:45:02,963 And so, I wonder if and I'd like your thoughts on thinking about it 696 00:45:03,083 --> 00:45:09,764 less as a "Is this software free?" but about "Who is in power in the community?" 697 00:45:09,843 --> 00:45:16,371 and so in a democratic sense, you could have the community that builds the tools together 698 00:45:16,371 --> 00:45:23,404 as government structures or as mechanisms for handling power that make the power 699 00:45:23,404 --> 00:45:28,723 bottom-up and more democratic and maybe that's more important than 700 00:45:28,723 --> 00:45:31,443 the technical status of each individual user. 701 00:45:32,563 --> 00:45:36,449 [Zack] So, as a concerned citizen and also as a political activist, 702 00:45:36,564 --> 00:45:39,011 I very much share your concern. 703 00:45:39,403 --> 00:45:46,484 I think we need to focus on what is in reach on us as geeks in this circle 704 00:45:46,723 --> 00:45:49,324 and have this kind of discussion in a different circle. 705 00:45:49,607 --> 00:45:54,803 So, as someone with activity in politics and as a geek, I very much try 706 00:45:54,803 --> 00:45:58,723 to actually explain to politicians and to activists the role of 707 00:45:58,843 --> 00:46:03,003 what we are doing here in very technical ways and the impact that it has 708 00:46:03,083 --> 00:46:04,363 on politics in general. 709 00:46:04,884 --> 00:46:07,283 And I think the ??? the talk later on this evening might have 710 00:46:07,363 --> 00:46:09,163 a thing or two to say about that as well. 711 00:46:09,523 --> 00:46:15,283 So from our part we need to understand it in some sense even if 712 00:46:15,283 --> 00:46:19,404 we advance a lot the status quo of user control of technology 713 00:46:19,444 --> 00:46:21,123 that we had thirty years ago. 714 00:46:21,403 --> 00:46:24,483 We have also started to lag behind many other areas. 715 00:46:24,803 --> 00:46:28,804 Something that I wanted to mention before but I fail to do so is that 716 00:46:28,843 --> 00:46:32,724 when I was doing my computing in the nineties, a lot of computations 717 00:46:32,843 --> 00:46:34,803 were mediated by clearly defined protocols. 718 00:46:35,403 --> 00:46:40,083 So we had RFCs or equivalent documents by other organisations which were like 719 00:46:40,243 --> 00:46:45,364 clearly marked paths to how to collaborate technically on the internet 720 00:46:45,603 --> 00:46:47,219 and how to make software talk together. 721 00:46:47,763 --> 00:46:54,644 In a sense, that culture of interoperability of protocols has actually started lagging 722 00:46:54,763 --> 00:46:57,403 behind a lot with respect to popular technology. 723 00:46:57,803 --> 00:47:02,923 So stuff like social networks, most of them except the good ones that free software guys 724 00:47:03,163 --> 00:47:08,764 try to build like pump.io or like diaspora, well all those technologies started up 725 00:47:09,003 --> 00:47:12,203 without any kind of interoperability in mind. 726 00:47:12,723 --> 00:47:18,123 So technically I think we need to push again on the direction of interoperability 727 00:47:18,165 --> 00:47:21,523 of protocols, and that's a technical contribution that we could do that 728 00:47:21,603 --> 00:47:22,804 will have an impact. 729 00:47:22,883 --> 00:47:26,683 You know, code is law, as Lessig was saying, and that would have a technical impact 730 00:47:26,723 --> 00:47:28,363 on the power structures you mention. 731 00:47:28,803 --> 00:47:30,603 That's my thought on this matter. 732 00:47:33,403 --> 00:47:35,563 [Q] I have an answer. 733 00:47:35,563 --> 00:47:36,563 Hello. 734 00:47:36,604 --> 00:47:40,083 I have an answer, sort of an answer to the previous question. 735 00:47:40,325 --> 00:47:46,563 This is of course the heart of the difference between free software and open source. 736 00:47:47,043 --> 00:47:50,683 The difference between free software and open source isn't nothing at all 737 00:47:50,883 --> 00:47:53,043 and it's not about licenses. 738 00:47:53,483 --> 00:47:55,603 It's about goals and aims. 739 00:47:56,043 --> 00:48:05,245 Over the past decades, many of us have chosen not to pick a fight with 740 00:48:05,524 --> 00:48:11,963 open source people just for an easy life and, you know, it's always easy to have somebody 741 00:48:12,402 --> 00:48:17,204 who might share some of your goals and to be able to collaborate with them. 742 00:48:17,723 --> 00:48:20,818 But less and less is it becoming the case that 743 00:48:21,723 --> 00:48:27,446 the goals of people who are doing open source are the same as the goals 744 00:48:27,643 --> 00:48:29,283 of people doing free software. 745 00:48:29,803 --> 00:48:35,124 You can see that very clearly in the responses from people like 746 00:48:35,124 --> 00:48:37,003 Google to things like the AGPL. 747 00:48:37,683 --> 00:48:39,563 And there are a lot of examples. 748 00:48:41,011 --> 00:48:45,203 So, one of the things that we can do to try and bring some of 749 00:48:45,363 --> 00:48:49,243 the new crop of developpers along with us is to actually make it 750 00:48:49,324 --> 00:48:51,483 a bit more of a fuss about… 751 00:48:52,243 --> 00:48:55,118 You know, let's not come ??? all Stallman about that, 752 00:48:55,118 --> 00:49:00,403 Stallman is not the best PR guy, but I think Debian can do a lot better than he can 753 00:49:00,626 --> 00:49:03,243 and we've probably got a lot more credibility. 754 00:49:03,923 --> 00:49:06,043 And individually, we have as well. 755 00:49:06,443 --> 00:49:15,004 What we need to do is we need to explain our vision to those new developpers 756 00:49:15,244 --> 00:49:21,843 who mostly are just being, you know, they see an open source marketing machine 757 00:49:22,123 --> 00:49:23,363 and we are something different. 758 00:49:25,583 --> 00:49:26,485 [Zack] Thanks. 759 00:49:26,485 --> 00:49:30,118 So there's not need to be questions and answers, so if you have comments, feel free. 760 00:49:31,433 --> 00:49:34,323 [Talkmeister] I think we're running short of time and we need to take one more question. 761 00:49:35,003 --> 00:49:37,843 So maybe one last or, Stefano, one last? 762 00:49:38,403 --> 00:49:38,963 [Talkmeister] We can. 763 00:49:39,843 --> 00:49:41,483 Ok, one last question or comment? 764 00:49:41,803 --> 00:49:43,684 [Q] Just a quick comment if I may. 765 00:49:43,963 --> 00:49:48,603 You talked about federated services and facebook and dropbox and that sort of thing. 766 00:49:49,163 --> 00:49:55,683 I think maybe the issue here is less about federated services but is about identity. 767 00:49:56,564 --> 00:50:02,043 If I have my own dropbox alike and you have your own dropbox alike, 768 00:50:02,197 --> 00:50:05,730 the problem is not that the two couldn't talk to each other, 769 00:50:05,923 --> 00:50:11,524 we have no way of negotiation of identity authentication, access kind of problem. 770 00:50:11,923 --> 00:50:14,203 I think maybe part of the answer to your question is 771 00:50:14,323 --> 00:50:18,043 "Can we come up with some way of allowing federated identity management 772 00:50:18,243 --> 00:50:22,243 for people in general and just us say". 773 00:50:23,163 --> 00:50:27,363 [Zack] I think this is very much related to what I was answering before to Aaron, 774 00:50:27,723 --> 00:50:28,963 in the sense "yes we could". 775 00:50:29,405 --> 00:50:33,486 We have shown in the past that we can come up with very smart protocols 776 00:50:33,486 --> 00:50:36,603 that allow people to technically interoperate over the net. 777 00:50:36,963 --> 00:50:40,644 But we are coming to late for that. 778 00:50:40,923 --> 00:50:44,972 Those big entities which now have the power to attract a lot of users to them 779 00:50:45,244 --> 00:50:49,123 developped before those standard that we could have used to make 780 00:50:49,404 --> 00:50:53,163 smaller entities interoperate could have been put in place. 781 00:50:53,529 --> 00:50:57,243 So yes, I agree with you, there is technical work to be done but in some sense 782 00:50:57,243 --> 00:51:01,883 we are late in doing that work and the question now is not only 783 00:51:02,124 --> 00:51:05,923 "How could we do the technical work that allows us to have smaller entities 784 00:51:05,923 --> 00:51:10,203 that interoperate for authentication or everything else?" and also 785 00:51:10,483 --> 00:51:15,563 "How do we migrate from the status quo to the ideal world that would be possible 786 00:51:15,603 --> 00:51:17,643 if those standards existed in the first place?". 787 00:51:18,206 --> 00:51:22,483 So in a sense I think we are a bit late and we have twice the work to be done 788 00:51:22,763 --> 00:51:26,083 before reaching the optimal and more federated situation which I think 789 00:51:26,243 --> 00:51:27,443 would solve the problem. 790 00:51:29,963 --> 00:51:31,444 So, thanks a lot. 791 00:51:31,603 --> 00:51:39,833 [applause]