They’re also a Dutch non-profit organization, and both their services and their infra are all developed/maintained in the open using exclusively open-source projects.

I guess you’re right in a sense that, I’m not aware of anyone specifically getting money with the job “just hurt them somehow”.

I don’t know if people receive money to say other things though. Like that a googlified phone or other things are secure (when they’re much less secure, and that can be proven in the technical realm). Do people receive money for that? I’m aggressively blocking all ads and barely watch any youtube at all, so I’m a bad judge for that. I’ve seen what looks to me as traces of that, but I could be wrong. So I’ll take back my claim and just state that I merely have doubts. Maybe someone can add more information on that. If they know whether people are getting for saying that google is secure, or that some of the alternative firmware is just as secure. It would not be attacking GrapheneOS then, but it would be attacking and muddying the truth.

Both absolutely true, AND they live in a world where a lot of money is being paid paid to attack them. It’s like elections in a corrupt country: on paper you may even have fair voting, but in practice there will be constant attempts at sabotage.

They live in a harsh world. Personally, I forgive them their paranoia. A huge chunk of security+freedom on mobile currently stands on their shoulders, and on PinePhone / Librem5.

I haven’t even watched the video, but if the server would implement sharing via torrents, it would be perfectly horizontally scalable, at minimum cost for the server owner. (I assume from the comments that it’s not what is going on at the moment though.)

P.S. Also, thanks for the clarification. It makes sense. I just have to read this more carefully, should I adopt the license. Do you use it by the way?

I was talking about mixing indeed. An example of a license that I think is less strong - but can be mixed with EUPL - is MPL (the Mozilla one). Your quote clarifies what happens in that case though: EUPL’s requirements still hold. I still haven’t looked at it sufficiently carefully. Also, sadly, the referenced page has multiple mistakes so I feel I need to read the actual license in detail before getting convinced. (My take on tivoization is also different than what the author of the page where he says “Note: This is still controversial: …”.) That page is also just a “news” article, and not a definitive source. So it’s OK to be less polished, but then it means a push for me to trust the license itself only.

From what I understood,

• Here is a good comparison of different licenses: https://interoperable-europe.ec.europa.eu/collection/eupl/solution/licensing-assistant/find-and-compare-software-licenses For example, if I want to compare with major GPL versions (AGPL-3.0, GPL-2.0, GPL-3.0), then here is a table: https://interoperable-europe.ec.europa.eu/licence/compare/EUPL-1.2;AGPL-3.0-only;GPL-3.0-only;GPL-3.0-or-later Although I also think they need to improve this comparison table, because as opposed to the first link, the table does not have an on-hover text to show again the meaning of the different rows.

• This is the English text of the license: https://interoperable-europe.ec.europa.eu/sites/default/files/custom-page/attachment/2020-03/EUPL-1.2 EN.txt

• Here you can see the license in other languages, also in PDF if you prefer: https://interoperable-europe.ec.europa.eu/collection/eupl/eupl-text-eupl-12

• Strong point of this license: it aims to protect your code and enforces it to remain free in a SaaS scenario, similar to AGPL.

• It allows mixing EUPL-1.2 code with other copyleft licenses, less restrictive than GPL. I haven’t carefully and slowly read yet if it can be used to simply circumvent the copyleft features. Has anyone else publicly analyzed it? Maybe it means that you can use e.g. GPL or MPL inside EUPL-1.2, but not the other way around?

• They clearly pin the jurisdiction! This is big boon. And one way or another, I clearly trust EU’s handling of licenses and law better than that of the US. (Sorry, but that is true.)

P.S. It’s interesting. Has anyone in this (fediverse) community used the license already? What is your impression?

P.P.S. Personally, I wish they would not start their PDF with preambles such as

COMMISSION IMPLEMENTING DECISION (EU) 2017/863
updating the open source software licence EUPL to further facilitate the sharing and reuse of software developed by public administrations
In order to further facilitate the sharing and reuse of software developed by public administrations concerning the use of an open source software licence, a new EUPL version, EUPL v. 1.2, should be adopted.

If I read this word-to-word, my brain wants to zone out. I cannot / don’t fully want to understand what they’re talking about. I want the license first, and I want to learn when and how it came to be later, on a separate page. (Not joking or being sarcastic here, I literally would want it later, e.g. last page or referenced below.) Otherwise it distracts attention and it gives me a feeling that they might be too full of themselves and busy virtue signaling, as opposed to being a strong ally and have my back covered. Maybe I’m exaggerating? Anyway, that’s just one downside. I do like some of the other parts listed above.

It is if you use cryptography or cryptographically secure hashing.

Still blocked. Europe, Wednesday 7 AM.

I agree. Specifically, it’s privacy AND freedom (free software development model).

If these two are against maximum security, GrapheneOS consistently chooses security. Which is unfortunate for me, because I would consistently choose freedom. (Especially due to long-term considerations.)

and distribute the apks on a different website

Or with distributed technologoes such as torrents. Then it’s cheaper to operate any required servers.

I think I can understand, especially if I categorize it as “data analysis” in my brain (could be the wrong terminology though, I’m not an expert). Possibly as part of a bigger actual research.

I agree that it’s helpful there. It’s probably also niche enough that AI-written websites don’t create 10 articles for every 1 legitimate as otherwise happens in 95% rest of the internet. You’re in a lucky spot.

I don’t know what kind of research you do personally, but for me, even purely for learning, AI is a total negative. Google and duckduckgo have essentially become unreliable. I can get “answers” to every question on earth so to speak, but I have no chance of knowing whether it’s correct, except if I already happen to be an expert in the area. That is somewhat offset by the fact that AI does good search and information retrieval if I can later verify for correctness. Also for leaning, sometimes I can throw code/info at AI and it may do a pretty good job at analysis, which may help facilitating learning (“research”?). But the total, especially for research, is a solid, solid negative.

And then I remember all the problems that are currently attached to AI, and… Yeah. Good job SourceHut for focusing on one problem at a time, and the problem now being to continue to provide reliable code hosting and development services.

Of course it’s affecting everything. I’m not claiming that they’re evil. But either them or their positioning, seems to be somewhat weak when given pressure. They’re not standing on solid ground so to speak.

Also makes System76’s standing a little bit weaker in my eyes. Still *obviously* among the good forces, but they nevertheless gave in to the pressure around and were ready to comply.

… *slightly offtopic* I hate what the US / Donald Trump / Money power is doing with people and companies…

According to this website https://github.com/BryanLunduke/DoesItAgeVerify

System76 also planned to implement age verification should the law pass. They did not claim that they’ll relocate or re-register their company legally, or request their users upon installation to not use the OS in California/Colorado, or anything like that actually.

I think that’s noteworthy. I personally consider it half a fight. Like, you create noise, but if boss says it’s OK, you say “OK, you’re the boss after all”.

That’s an example of a good LLM policy, especially for projects like forgejo / sourcehut / codeberg. Happy to see this approach is getting adopted more and more. (The main Rust repo recently also got a similar policy, although a bit weaker still.)

The way I interpret it is that offline code review is fine. However, online AI-made comments or code suggestions on the platform are explicitly not allowed.

A policy I find very reasonable for projects like forgejo / sourcehut / codeberg.

It is true that merely from the observation of old things, you cannot conclude that all things lasted long.

But as a matter of fact, from different observations by many people and areas, mid- to high- end stuff really lasted much, much longer. It was as an average rule more simple, less compact, and it lasted and still lasts really long without degradation.

Thanks! Also, FOSDEM is a huge bridge to trust building for me. I think that’s actually sufficient for me. Will root for this project and support it!