Re: Next Steps For the Software Heritage Problem (Dale Mellor)

Re: Next Steps For the Software Heritage Problem (Dale Mellor)

[Andy Tai]

> Date: Wed, 19 Jun 2024 09:36:29 +0100
> From: Dale Mellor <guix-devel-0brg6a@rdmp.org>
> I use Guix as a tool to develop my own projects, private and
> personal for reasons I'm keeping to myself.  As part of that I write package
> definitions for them, and use the Guix machinery to build and test.  I *cannot*
> have Guix just giving my code away to anybody, that is just fundamentally wrong.
>
If you release software as free software, you are giving away
software, to anybody and everybody.

>   We need to ask what is Guix?  A free operating system, a framework for
> developing free operating systems, or a more generic tool for software
> development and deployment?  If the latter it *cannot* do nefarious things
> without explicit consent.

Guix is a free operating system _and_ a generic tool for software
development and deployment.   It makes no sense to say it does nefarious things
without explicit consent.  Just like you cannot try to prohibit GNU
Make from being  used to do nefarious things like building malware.
You cannot place usage restriction on free software.

>
>   I think at least there should be a /restricted/ license type available to
> package definitions, and the system absolutely should not give source code away
> from packages which use this (of course, they won't get into the official
> distribution, but that's fine).
>
How can you restrict others from posting links to your content, as
what essentially package definitions in Guix are.

>   More broadly, I think they should just stop inter-operating with SH.  Just
> walk away.
>
> Dale

Re: Next Steps For the Software Heritage Problem (Dale Mellor)

[MSavoritias]

On Thu, 20 Jun 2024 14:43:30 -0700
Andy Tai <atai@atai.org> wrote:

> > Date: Wed, 19 Jun 2024 09:36:29 +0100
> > From: Dale Mellor <guix-devel-0brg6a@rdmp.org>
> > I use Guix as a tool to develop my own projects, private and
> > personal for reasons I'm keeping to myself.  As part of that I write package
> > definitions for them, and use the Guix machinery to build and test.  I *cannot*
> > have Guix just giving my code away to anybody, that is just fundamentally wrong.
> >  
> If you release software as free software, you are giving away
> software, to anybody and everybody.

Legally yes. But I think Dale talks about the social rules that I have been repeating in these threads :)
 
> >   We need to ask what is Guix?  A free operating system, a framework for
> > developing free operating systems, or a more generic tool for software
> > development and deployment?  If the latter it *cannot* do nefarious things
> > without explicit consent.  
> 
> Guix is a free operating system _and_ a generic tool for software
> development and deployment.   It makes no sense to say it does nefarious things
> without explicit consent.  Just like you cannot try to prohibit GNU
> Make from being  used to do nefarious things like building malware.
> You cannot place usage restriction on free software.

We already do tho! We restrict what one can do if they interact with GPL code. Aside from that even Guix uploading all code from the packages to
SWH that basically feeds it to a LLM model is indeed not honoring consent of the author of the package. What you can do legally doesn't matter if you are an asshole after all.
So in this context it absolutely makes sense. Because we have social rules around consent and Guix doesn't seem to be following them currently.

MSavoritias