Re: IceWeasel-UXP and IceDove-UXP

[N <ng0@n0.is>]

guixuser transcribed 680 bytes:
> 
> > To be fair,
> >
> > -   iceweasel-uxp has a different engine than icecat.
> > -   There is no good email client like thunderbird. I'm stuck with
> >     claws-mail, and I reallly don't like it. icedove-uxp would be a good
> >     addition.
> 
> Exactly.
> 
> > -   icedove-uxp and iceweasel-uxp are likely to have similar dependencies
> >     given they are a part of the hyperbola project. It will probably be
> >     simple to write a package for iceweasel-uxp and iceape-uxp after
> >     icedove-uxp is written.
> 
> True.
> 
> >     I think I can port icedove-uxp, and guixuser can use my code as a
> >     template for iceweasel.
> 
> By port, do you mean packaging into guix?
> 
> Sure I can try that.
> 
> thanks.

As I wrote on IRC, I'm sceptic about the -uxp projects in hyperbola.
They can be imported here and be watched in the long-term.

There are a couple of problems to looks at:

- The committer list of uxp upstream and its hostile way to approach
  brand defense (been there, dealt with it off-list, but was lucky enough
  to read the complete license exeptions before contacting them. look at
  freebsd who got shouted at in github for even daring to have a public
  work-in-progress package and then asking).

- The people who work on it in Hyperbola are far less than for example
  people paid to do the work in Firefox (or Thunderbird, though I'm not
  sure if TB is paid for). Money matters, and I can fully understand why
  so few people with so few patches work on the 2 projects in hyperbola.

Which leads me to:

- My experience in Guix about packaging and accepted packages is that it
  is not only about licensing and ensuring software freedom beyond what
  upstream intended to, but also about ensuring user security (see the
  countless hours invested by our Icecat maintainer in backporting
  patches from Firefox, etc). Given that Hyperbola is an Operating System,
  do they hold their own software accountable to the same standards they
  check external CVEs (etc) for?
  With Mozilla and downstreams of Mozilla, we get at least the dedication
  to checking for bugs and ensuring they get fixed.

- Decisions in Hyperbola I read which argue for why this was done are
  questionable from my personal point of view. It is easy to fall into
  the "Rust is bloat" trap. To mention it as one of the main arguments
  why this fork exists is odd.


Closing note: please decide to post to one list, not 2 or more :)