prism-break / prism-break

Privacy/security-oriented software recommendations (mirrored from GitLab)
https://gitlab.com/prism-break/prism-break
GNU General Public License v3.0
1.27k stars 287 forks source link

Replacing dudle with Framadate. #1421

Closed anarcat closed 6 years ago

anarcat commented 9 years ago

dudle isn't really developped anymore. the framasoft people picked it up and created a SaaS version, and are releasing the source code so you can run your own. see:

https://framadate.org/ https://git.framasoft.org/framasoft/framadate

... and so on.

ghost commented 9 years ago

:+1: for the framasoft version, they're doing a great job

kofronpi commented 8 years ago

Yeah, I also don't understand why there is Dudle and not framadate.

theltalpha commented 8 years ago

What's wrong with Dudle?

anarcat commented 8 years ago

"dudle isn't really developped anymore"

@theltalpha

Zegnat commented 8 years ago

dudle isn’t really developed anymore.

The last commit (revno 583) is timestamped Tue 2015-07-07 22:08:08 +0200. We have projects on here that have been abandoned for way longer.

the framasoft people picked it up and created a SaaS version, and are releasing the source code so you can run your own.

The Framasoft people picked up STUdS, not dudle, so I don’t know how much overlap there really is in the projects. Yes, both allow for polls, but dudle is mainly on the list because it allows for encrypted votes and other privacy features that make it interesting. Can someone tell me if STUdS or Framedate have any privacy features? I have a hard time navigating French pages.

Another problem is that the Framedate licence may be incompatible with PRISM Break. They use the French CeCILL licence, but a variant (CeCILL-B) from 2006. Only CeCILL Version 2 is mentioned by the FSF, and the OSI approved CeCILL version 2.1 in 2013 but no other versions. None of the guidelines used by PRISM Break make mention of CeCILL-B.

I hope someone closer to this can clear up some of these issues.

vyp commented 8 years ago

@Zegnat Well I haven't actually read the license (and even then, I'm not a lawyer), but the actual license says that one of its main prinicples is to be a Free Software license (at the beginning): http://www.cecill.info/licences/Licence_CeCILL-B_V1-en.html

Of course, I wish it was mentioned on the license-list page, because that's usually the reference to use to determine if a license is a FSF-approved free software license or not.

Grasping at straws, but the wikipedia page: https://en.wikipedia.org/wiki/CeCILL says "Yes" under the "FSF approved" section, whereas it says "Yes (2.1 only)" for "OSI approved". So with the same logic, if CeCILL-B wasn't free software, maybe it would have indicated that for the "FSF approved" section like it did for the "OSI approved" section (for everything other than v2.1).

Zegnat commented 8 years ago

Grasping at straws …

Very much grasping. Note that Wikipedia separates CeCILL-B and CeCILL-C as other licences. About CeCILL-B specifically, Wikipedia says it includes “a requirement normally not allowed by the GPL itself”. Going as far as to say CeCILL-B “may be incompatible with the original CeCILL license”.

If Framedate was licensed under the normal CeCILL license there wouldn’t be a problem. But they are using a variant that isn’t accepted by the people PRISM Break is publicly basing its policy on. I don’t expect anyone here being a qualified copyright lawyer to weight in, and that’s exactly why we specifically state to follow the FSF and OSI definitions.

Edit: my apologies to @vyp incase he thought my partial quote at the start was a sneer. It wasn’t. All meant in good faith. On reading what I wrote, I see it could be seen as an attack on him, and it wasn’t. My normal tone of conversation does not carry well in writing.

theltalpha commented 8 years ago

"dudle isn't really developped anymore"

So what? Doesn't it do what it is intended to do? Are there open security/privacy issues? Are there important features missing in respect to its intentions? I don't see what is the problem if it isn't developed any more when it is finished. Or what are the developments you would like to see?

anarcat commented 8 years ago

On 2015-12-08 08:34:38, Martijn van der Ven wrote:

dudle isn’t really developed anymore.

The last commit (revno 583) is timestamped Tue 2015-07-07 22:08:08 +0200. We have projects on here that have been abandoned for way longer.

the framasoft people picked it up and created a SaaS version, and are releasing the source code so you can run your own.

The Framasoft people picked up STUdS, not dudle, so I don’t know how much overlap there really is in the projects. Yes, both allow for polls, but dudle is mainly on the list because it allows for encrypted votes and other privacy features that make it interesting. Can someone tell me if STUdS or Framedate have any privacy features? I have a hard time navigating French pages.

oh! i guess i confused studs and dudle.

vyp commented 8 years ago

@Zegnat Good point about CeCILL-B being mentioned in the others section. But I don't think being incompatible with the original CeCILL or having a requirement normally not allowed by the GPL necessarily means its a nonfree software license.

And a nitpick, but that CeCILL-B point is actually one big sentence, so I think it makes better sense to see it as a whole:

CeCILL-B, which is fully compatible with BSD-like licenses (BSD, X11, MIT) which have a strong attribution requirement (which goes much further than a simple copyright notice), a requirement normally not allowed by the GPL itself (which describes it as an advertising requirement), and so this license may be incompatible with the original CeCILL license, if BSD-like components are integrated, unless the software uses a dual-licensing scheme and conforms to the licensing terms of all embedded components.

So first it says it's compatible with BSD-like licenses, which we know are FSF approved free software licenses. It then says that the BSD-like licenses have a strong attribution requirement. And this strong attribution requirement is the requirement being referred to in the "a requirement normally not allowed by the GPL" part. And that is why it says "it may be incompatible with the original CeCILL license" (if BSD-like components are integrated).

But because we already know that the BSD-like licenses are free software licenses, I think this potential incompatibility is fine, right?

Anyway, we have to remember that we are analysing a wikipedia page here, definitely not a canonical resource by any means, which is why I mentioned it would have been nice if the license-list page clarified this for us. I have contacted the FSF about whether or not the CeCILL-B license really is a FSF approved free software license, and was simply forgotten to be listed on the license-list page, or otherwise whether it was not mentioned/listed on purpose.

Hopefully they can clear things up. But if they don't, I'm going to have to agree with you @Zegnat that we should not include something that potentially may not be in accordance to Prism Break's inclusion policies (at least until someone can clear things up). It seems pedantic, but for a site like Prism Break, I think it's better to be safe than sorry.

Edit: ...

All good! :) Off topic, but yes, it's hard to convey tone through text! (Especially for those where English is not their first language, like me, and maybe you too?) If you want to be explicit, I find that using smileys/emojis can lighten it up.

Anyway, all you did was quote me and give a good point refuting what I said. That's not an attack! In my book, an attack is explicit namecalling/flaming and/or calling out the person rather than the idea itself.

Also, the shorter the quote, the better imo, as long as the context is still there or not forgotten. Because it simply takes up less space.

pyg77 commented 8 years ago

Hello, I'm one of the maintainer of the Framasoft community (a french non profit NGO)

You're right : Framadate was based on Studs, but the 95% of the code have been rewrited (just make a diff if you want to be convinced :) ) If the Cecill license (wich was a studs choice) is a problem, I think we could change the license to Affero GPL quite easily (but not quite quickly)

By the way, I invite you to take a look to https://degooglisons-internet.org website (available in english! ;) ) to see the work we are doing on attempting to de-google-ify the net. Of course, we recommend prism-break when we do conferences, talks, etc. But the main issue is that we mostly speak with general public who just can't (or want) install tools like duddle. That's why we propose more than 15 alternatives (Etherpad, Owncloud, Framadate, diaspora, ethercalc, etc) only based on FLOSS. We host those services, open for free, with a ethic and moral charter https://n4.framasoft.org/nav/html/charte.html and easy to read Terms Of Services. This is a great success in France (1M visits/month), and that's paradoxaly why we don't provide those services in english or other languages (we couldn't host millions of users for free).

Do not hesitate to contact me if you want further information.

Oh, and I forgot to mention that we provide also some interesting tools for prism-break:

Keep up the awesome and inspiring work done here! Pierre-Yves

vyp commented 8 years ago

@pyg77 Thanks for taking the time to respond here, much appreciated!

If the Cecill license (wich was a studs choice) is a problem, I think we could change the license to Affero GPL quite easily (but not quite quickly)

The FSF has responded to me:

CeCILL-B and C are actually on the docket for review in the very near future. We receive many requests for review, and reviewing licenses is a time intensive process often requiring input from legal counsel. As such, we have a pretty big backlog. But these licenses are right at the top of that list, so getting our public statement on them should be forthcoming. When we release the review, it will be added to the license list and we will publish an announcement letting everyone know the outcome. Thanks for checking in on this, and keep an eye out for the announcement.

So you may not need to go through the trouble of changing licenses. This does however confirm that CeCILL-B right now is not actually FSF-approved, so it's not 100% clear if it's a free software (as defined by the FSF) license or not. And Prism Break's inclusion policy is to only include free software, barring certain situations (such as in the web search category).

Remember, changing the license may be impossible if CeCILL-B does not allow sublicensing, because you would then have to get the permission of all your contributors to the software to do so. So even if everyone agrees, the process may still take time. And although the FSF said "very near future", they haven't actually given a definite date (not sure that they can), so CeCILL-B becoming FSF-approved, _if_ it is accepted, may also take time.

Personally I think the AGPLv3 is an excellent choice for a license though, especially for Framadate. So you may want to (try to) switch to it even if CeCILL-B is accepted by the FSF, because I'm not sure CeCILL-B provides the protections that the AGPL does, which you might care about.

pyg77 commented 8 years ago

@vyp thanks a lot for this update from the FSF.

We already know how to change the license of framadate. Hopefully, we have not so many contributors https://git.framasoft.org/framasoft/framadate/graphs/master and, by a total coincidence, I met yesterday the author of studs (he prefer a BSD/MIT license than the Affero GPL, it"s not my favorite choice, but I think I could accept that).

By the way, it will take weeks, maybe months to get there.

During this time, do not hesitate to contact me if you want further informations on https://degooglisons-internet.org/ or if you know organizations (like Riseup, for example) that provide packaged services listed on prism-break directory.

vyp commented 8 years ago

@pyg77 Thanks!

During this time, do not hesitate to contact me if you want further informations on https://degooglisons-internet.org/

Will do, the website is very nice by the way!

Zegnat commented 8 years ago

@pyg77, thanks for dropping by!

I met yesterday the author of studs (he prefer a BSD/MIT license than the Affero GPL, it"s not my favorite choice, but I think I could accept that).

I am personally a big fan of the freedom offered by BSD/MIT style licenses, and those licenses have been weighed and found to be OSI and FSF compatible. A possibility would be to dual-license the project under both a canonical BSD variant and CeCILL-B. This way European companies can feel safe in getting BSD-like freedoms under CeCILL-B (which I understand is BSD-for-French-European-copyright-law?), and everyone else understands the BSD licence.

I am looking forward to checking out what Framasoft has been up to with the other projects, and what degooglisons-internet.org might be able to bring us. Always happy to see these kind of projects coming out of Europe!