FSFE Community Blogs

Take a look at the actual technical rationale: https://blogs.fsfe.org/larma/2016/microg-signature-spoofing-security/

I understand why this seems alarming to a bystander. But if you're still dubious go read the Gerrit reviews--it's pretty clear the CM team was unwilling to accept the patch because "it allows one app to impersonate another" not because it presents a security hole. The patch went through multiple iterations ending on one that means users would literally see a prompt:

"microGapps is requesting permission FAKE_SIGNATURE to ..."

The point is that it's not a security concern _if the user allows it_. By definition.. it's tautologically impossible to classify such a scenario as a security concern if the user selects "this is not a security concern" when asked if they're concerned about about allowing microGapps to fake the google play services signature.

The microGapps team then asked "how would you propose we land on a solution so that we can provide an alternative to gapps while still checking the [x] security box? The CM team failed to provide any sort of compromise stating that allowing one app to impersonate another is not a feature they were willing to support on their platform.

So you see, it's not security that was the issue. The issue is that the CM team was unwilling to give users the freedom to allow the system to work as they want. What's infinitely ironic is that CM used to ship with root. It was the community fork "for the community by the…

It is the ThinkPenguin, yes. I bought it at an extra and with an underwhelming GPU exactly because it is designed to work nice on linux and only has devices that work with open-source drivers. Yet, the GPU fails under debian. After hours of tinkering and googling, I concluded I have the same issue as this guy: http://blogs.fsfe.org/the_unconventional/2014/11/12/debian-x-drivers/

Add to that that the basic install does not allow USB to be automounted by a user. I did manage to get this one to work after a wasted hour or two, but I don't consider it normal that this is not default behavior or at least very easy to configure. In 2015.

Both these things worked flawlessly out of the box on a Ubuntu with KDE.

As for nostalgia, I actually do not remember stumbling on a case like the intel GPU before: "We are holding bugfixes because we don't like the name of Intel's package". Actually, every time I try to go back to debian, I arrive with a ton of motivation thinking "this time I am going to look deep into the issues and solve them!". This particular issue had no good solution: it would have required me to install the intel driver and accept that my system would probably break at the next big update.

I am used to the old proprietary vs open debate and the horror of binary blobs. Here it is not the case.

"Is Office even necessary anymore?"

Can't speak for OP but for many people, yes, it is. My sister works in arts admin. Dealings with funders are done using Word files with macros and protected areas. Works ok on Mac Word (they use Apple at work) but not with Open/LibreOffice.

When I set up an old thinkpad for my sister to use at home, I suggested Ubuntu and got an earful. So an OEM copy of Windows 7 and she got a licensed Office 2010 under her employer's licence agreement.

Also William Gibson...

"Word is, I'm told, horrid, but it talks to publishers, which is really all I use it for."

http://william.gibson.usesthis.com/

I really hope the UK government can stick to this...

https://blogs.fsfe.org/gerloff/2012/11/01/the-uks-new-open-standards-policy/

(It was posted to HN some days ago)

Not standard LineageOS, but LOS forks that provide microG in place of Google Apps have to support "signature spoofing" so that MicroG can impersonate the missing proprietary Google apps.

More details here: https://blogs.fsfe.org/larma/2016/microg-signature-spoofing-security/

> I’d also like to point out a myths I heard regarding signature spoofing. Some people assume, that signature spoofing allows to break the Android signature security model and thus rogue applications can access private app storage. But in fact signature spoofing is only applied after installation if the permission was granted, it has no influence on the package manager security model.

The EU court case against Microsoft, with FSFE and the Samba team fighting the good fight, was also a major step in getting there.

It was one of the "first few major cases" in the EU against tech, and the testimonies from the open source side had been great in explaining to the judge just what they wanted (what they didn't want at all, despite Microsoft claiming otherwise)

Then Microsoft got a fine by day and tried to play the force card by refusing to pay for a while.

https://fsfe.org/activities/ms-vs-eu/ms-vs-eu.en.html

https://blogs.fsfe.org/gerloff/2011/05/27/samba-case-hearing-how-microsofts-gamble-backfired-2/