Does RYF certification even matter

Just to note, the Librem 5 was “tentatively recommended” in FSF’s 2020 Gift Giving Guide:

https://www.fsf.org/givingguide/v11/

While I will buy products I need/want not on the FSF’s “Respects Your Freedom” list of approved product’s, all things being equal, I do take their recommendations seriously.

For example, I bought this product (TPE-R1200 Wireless-N Mini Router v2). It is a nice little router :slight_smile:

https://ryf.fsf.org/products/TPE-R1200

2 Likes

What I want:

  1. A mobile device that puts the user back into control of software and hardware.
    Especially in regard to not emit LTE/WiFi/BT when the user does not wish to do so.

  2. A mobile device that is not made in People’s Republic of China.

Do I care about the Firefox icon not being free? Definitely not.
Do I prefer a useless device just because key functionality is not yet free? Definitely not.

A perfect example is Firefox.
Firefox is currently simply the best working browser on Librem 5.
A browser is an essential piece of software for every device that has Internet connectivity.
Without Firefox Librem 5 is not a usable device and the user is forced to turn back to devices that are much worse than Librem 5 in terms of freedom.
I would go even further. For me, considering that there are important functionalities for which there are no well functioning options at all, it would be a total waste to invest time in Gnome Web at the moment. For Gnome Web there is a good alternative - Firefox. So it is better to focus in areas, where we still have no options at all.

As I mentioned earlier for example being able to make Video Calls with the front camera in apps like Signal would be a pretty key feature for me.
I don’t get any utility from a totally free device if I have to own a second totally non-free device.

So to sum up, do these certifications matter? NO, they don’t.

3 Likes

At the end of the day what does freedom means?

I might be free to cut a steak with a baseball bat.
But the problem is, that a baseball bat is not really a tool to cut a steak.
So I end up still not being able to cut my steak and ultimately I end up not being free to cut is just because I don’t have the right tool to do so.

This is a very implausible statement.
New software products come on the market all the time and at the beginning nobody knows about them. Many of the successful software products became popular without large marketing budgets. Especially nowadays with the power of social media. So it is not about popularity.

In my opinion, the largest problem is, that FSF is often not the best solution for the users. As an example again - The GNOME Web.
If GNOME Web was the best browser, I would use it. But it is not. Period.

A person who does not care, will simply use the best product. And a person who cares about FSF might end up not using FSF because of lacking comfort.
So FSF must become the best product in some areas in order to become popular.

FSF is not a product. It’s a non-profit organization trying to explain to users why free software is important for their own freedom. Firefox is also free software, and many use it without knowing about it. Gnome Web is not even developed by the FSF AFAIK.

Do you support freedom of speech because it gives you better “products” than the alternatives? No, it’s crucial for the democracy. Same here.

Kyle seems to think the FSF is too resource constrained to have got round to certifying the Librem Key. I think though that if they are so resource constrained that they can’t evaluate a product like that in several years, it becomes hard to see what modern products they could have the resources to reasonably evaluate. It’s hard to see how the certification could remain useful and relevant with that little functioning capacity.

If the issue is not purely capacity but particular points of the certification not being met I think it would be helpful for the FSF to develop slightly more nuanced categories that better acknowledge the difficulty of producing genuinely open products. They could keep the “pure” certified status, while perhaps also having a “best currently available device in category” or similar for areas where a totally free option doesn’t (maybe cannot) exist but where there are still huge differences between “mostly respects the user” and “doesn’t even try”.

1 Like

Gnome Web has improved a lot recently and is (IMO) becoming a viable alternative. Personally I would also prioritize areas for which there are currently no good options, but having a strong alternative browser engine implementation is important I think.

That’s rather untrue. If it was true, people would not be swayed by marketing. People would not buy products that they later have to return.

In reality, people who don’t care choose the easiest option. The saying “nobody got fired for buying Oracle” comes to mind. Same with paying for Windows and then only using the browser. Same with using Facebook for chats where superior alternatives exist. Buying a used car that turns out to be a lemon.

People regularly buy worse products which are simple visible. That’s why marketing is extremely important. If you don’t know that somethig exists, you won’t know you want it. If people don’t know FSF, it diminishes its importance. Conversely, people who know FSF may even choose worse products because of their endorsement.

4 Likes

I mixed things up. You talked earlier about the FS Foundation while I meant free software with highest standards of freedom.

Definitely.
Pure luck is also very important for anything to succeed.

But what I mean is, that when some free software products are so inferior to non free products that even free software fans don’t use them, then the whole process of recommendations, word of mouth ect. (which is also a form of marketing) does not take place.
Even people who know about Gnome Web, don’t use it and would not recommend it. This is something you can’t just fix by burning through marketing budget.

So having a really good product is essential.

Firefox is not Free Software because is not 100% Libre. Firefox with the propietary icon it is an opensource packages.
So PureOS need wash the Firefox icon to one Libre, like Iceweasel or.

The Firefox logo binaries are now published under the the FOSS MPL license (https://hg.mozilla.org/mozilla-central/rev/99d80bc3f18b) and Debian ships standard Firefox instead of Ice Weasel again now too (though interestingly FDroid still publishes Fennec with the logo changed).

It doesn’t grant you trademark rights but that’s well outside the scope of FOSS as far as I’m aware (and seems reasonable to me).

2 Likes

One of the reasons why I initially ordered the L5 was because Purism said that it intended to get RYF certification for the device, so the certification did matter to me 4 years ago. However, after studying in more detail the RYF certification and reflecting on what it means for the L5, I have concluded that RYF certification is doing little to advance the cause of hardware freedom and the RYF certification requirements and process need to be reformed.

First of all, the language of the RYF requirements is unclear regarding proprietary firmware updates, and when I have written the FSF asking for clarification, they never responded to my repeated emails. I don’t see how any company can work with them, when they don’t respond to requests for clarification on their own requirements.

The second problem is trying to create an arbitrary distinction between hardware which doesn’t change and software which does change. In modern hardware, it is frankly unsafe to not allow hardware to receive proprietary firmware updates, and a modern computing device has half a dozen components that need firmware updates. Basically no modern device can contain WiFi, Bluetooth, cellular modem or GNSS and meet the RYF requirements, so a binary Pass/Fail certification makes little sense. No hardware maker dares release enough info about those components so the community can create FOSS firmware due to the patent situation and I doubt that the FCC would allow hardware makers to ship a wireless transmitting device that users can easily alter to transmit at different frequencies. Now that the POWER10 is using Synopsys’s proprietary DDR4 RAM timing code (just like the NXP i.MX 8M Quad), I wonder if you can even find a modern processor that truly complies with the FSF’s requirements, however there is a huge difference between the normal phone and the L5 and the normal PC and a Raptor system, which is why the binary RYF certification makes no sense in the real world, because it gives no encouragement to companies that are trying to do the right thing.

I posted my ideas about how the RYF certification should be reformed, if anyone is interested. I also like @db579’s suggestion that the FSF make recommendations for what is best available per class.

3 Likes

Bottom line up front: more than it used to; and not enough as it should.

FSF, in my view, is like Consumer Reports for a select group of nerds. The kind of people that would talk to you about operating systems at a party. For the record, I am that guy in my circle of friends and family.

I believe it DOES matter. And properly executed, can mean more than it does now.

I have more non-technical people than ever talking to me about privacy than ever before. More than security even. I get approached unbidden by people wanting to know how they can keep their data from prying eyes.

Bit by bit, people are waking up. The hard part about it is the asymmetry of knowledge. For example - in Mudge’s testimony before the Senate Judiciary Committee, Mudge himself indicated that within 20 minutes they knew key information about a potential malicious actor: location, name, online aliases, device, alternative accounts, etc. But no one is discussing how that data came to be in their hands.

IP and cell tower geolocation and device identification are technical parts of it. But being able to JOIN on data sets to build a dossier on a private person is not being fully discussed. Where are the data sets from? How did Twitter get them?

But bit by bit, people are waking up.

For those of us that are “the nerds of the family/friend group” - I see that we have a responsibility to remain even in our analysis, if we show up with grave accusations we come with demonstrable evidence, and we promote FSF, FOSS, and more where we can by showing that it is the better option.

People want to be secure. But there’s a limit to the sacrifice they’re willing to make. We have to find a way to meet them where they’re at.

The number of questions I get about when I’ll get my L5 is about 1-2 a month. From various parties. It’s been embarrassing to have been repeating, “Not yet. Soon” for three years. But it is what it is. My time will come. As it will for the rest of us.

The interest is there. The curiosity is there. We just need to tap into it and show people it’s possible to get what they want - live a technical life without having to feel as if the world is watching them undress.

2 Likes

So the certification definitely matters at least for new people who do not have time to read a ton of info about the certification and to reflect on that?

I think it would be already a big step to certify the bare Librem 5 device without external cards (WiFi and modem). People will still be free to buy them together and use Librem 5 as a phone, but the certification will definitely attract more enthusiasts.

For such cases, it helped me to show the Pinephone and explain that a more performant and better alternative (Librem 5) is on the way.

2 Likes

This makes sense.

1 Like

Firefox is Free Software. Please read what the FSF has to say from ( https://www.gnu.org/philosophy/free-sw.en.html “What is Free Software”). It’s about the 4 Freedoms. Note where they say:

Rules about how to package a modified version are acceptable, if they don’t substantively limit your freedom to release modified versions, or your freedom to make and use modified versions privately. Thus, it is acceptable for the license to require that you change the name of the modified version, remove a logo, or identify your modifications as yours. As long as these requirements are not so burdensome that they effectively hamper you from releasing your changes, they are acceptable; you’re already making other changes to the program, so you won’t have trouble making a few more.

The FSF does declare the Firefox License (MPL2) as Free. https://www.gnu.org/licenses/license-list.html

Good suggestion.

I can see this but there is the opposite perspective. Let’s say we allow shades of grey. How do you quantify the greylevel? What if, when comparing two potential devices, one is strongly free in one area and not so good in another? What if two devices are identical in all areas except one but it is not clear which device is “better”?

So you may have a choice between … a simple pass/fail where no device can ever pass or a somewhat arbitrary and potentially quite complex load of information giving some kind of greylevel or greylevels.

Maybe what is needed is to keep the simple choice of pass/fail but change (weaken) the criteria so that passing is actually possible.

Could that be dealt with in hardware? So that, no matter what the firmware says, the actual RF transmitter hardware is limited by frequency (and transmit power).

1 Like

Sending emails to the FSF for asking might not be a bad idea. They might feel that there is an audience who cares about the RYF certificate for the Librem 5…

Here is an email address (licensing@fsf.org). It is the same email address that should be used for entering the RYF certification program (probably the same that Purism used too), and the same to use “if you have any questions”. It might be the right address for asking politely about the Librem 5.

2 Likes

I already sent two emails to that email address asking for clarification on whether RYF allows updates to proprietary firmware or not, and they never responded. I can send a third email, but I suspect that the response will be the same. See: Does Respects Your Freedom certification allow updating of proprietary firmware?

2 Likes

I really hope the FSF will be able to address this issue.