Discussion

discussion@lists.fsfe.org

1 participants
3272 discussions

None
by None 23 May '24

23 May '24

people are unaware, of what consequences their decisions are imposing. E.g: The software patent law: Switzerland was in favour of it... and as soon as we seen it a lug startet to make a pedition... in the end Switzerland did not cast a vote. So we consider this a partial victory. IMHO_ON The real question is as to how we let the FSFe gain so much weight, that it is considered an important source of information / opinion by the governments and politicians of these lands. IMHO_OFF What do you think? -Philipp Wollschlegel

1 0

banking and Free Software
by Florian Snow 09 Mar '24

09 Mar '24

Hello everyone, As part of my job at the FSFE, I have been working on the topic of Free Software in banking and I would like to share some of my findings and thoughts with you. This is part of the larger topic of appification/forcing users to use non-free apps to do certain interactions. Personally, I noticed over the past years that banks are trying very hard to push their non-free apps for banking in general and also for what they call two factor authentication. In fact, they often block other means of authentication altogether. This is of course a problem for us and so I dug a little deeper into this topic. The Dutch FSFE team made a wonderful start here by contacting a bank about why they make it difficult to use Free Software while using their services. My task was to follow up in a more general way. Unfortunately, it has been very difficult to get answers directly from banks. A very common response was that there are legal requirements to do things the way they do and that the technical departments made sensible decisions that shouldn't be questioned too much. One reason that banks did sometimes point to was PSD2, an EU Directive that regulates payment services and payment service providers. The way I see it after doing some background research, PSD2 doesn't appear to require specific technical measures, also not for the second factor. However, the way banks interpret PSD2, it means they need to tie the secrets used for authentication to specific hardware. In my opinion, this interpretation is the first problem for Free Software because even though this may not be a legal requirement, it rules out two factor solutions such as TOTP where the secret could be used on multiple devices or simply extracted by using a TOTP app that allows that. The second big problem here is that banks "tie the authentication secrets to the hardware" completely in software. This is what necessitates the banking apps to do checks for rooted phones and so on because if a phone is rooted, the secret could theoretically be extracted. The root checks usually happen through the use of libraries in the apps that promise security even in malicious environments, such as a phone infested by malware. The banks currently rely more on this promise of security than actual security because real security would mean implementing proper two factor authentication instead of running two apps on the same phone and calling that two factor authentication. The problem with these issues combined is that because virtually all banks do it this way, it has become somewhat of a best practice. Banks fear that if they were to do it differently, they could be held liable in case of an alleged unauthorized transaction. Unfortunately, just like in other areas, it is often easier to do what everyone else is doing, even if it has flaws because at least you can defend what you're doing by saying you're following the "standard". And in this case that means restricting Free Software as a side-effect. A kind of way out of this is the use of secure elements of phones. By using them, the authentication secrets would actually be tied to the hardware. This would mean Free Software could use the secure element in a similar way to a smart card where we simply ask it to sign a transaction and that way, the root checks and non-free apps would not be necessary. However, just like with a smart card, there would typically still be non-free computations happening in hardware. So this would not be a perfect solution either. The bigger problem, though, is that there is no standard way of communicating with secure elements and that makes it tricky for banks to use them, plus they would need to maintain a list of secure elements, just like a list of CAs. In addition to that, banks might not move to that solution if there is no certification for it while they have a working solution; there's simply not much of an incentive for them to change what they have. One thing I found out is that banks often still use older standards that allow access with Free Software. For instance, some apps give error messages with HBCI error codes. This sounded promising at first because if there still is a system somewhere that is compatible with Free Software, then perhaps we could access it. Unfortunately what often happens is that banks apparently just put another layer around an older interface and then only provide the newer layer to the outside world. This may even make sense from a security perspective if maintenance of those older systems is tricky. It enables banks to continue using legacy systems internally without exposing security holes while still staying somewhat modern on the outside. That means it's not as simple as saying that they run HBCI internally, they might as well give us access as they used to. Another way in is that banks are required to provide access to third parties to enable new services on top of existing bank accounts. Unfortunately, while this would theoretically enable someone to provide such a service in Free Software, typically the second factor app from the bank is still required for logging in, so that doesn't help us all that much either. At some point, I thought there was one example of a bank that does allow TOTP as a second factor (or no second factor at all): Paypal. But from what I understand, Paypal doesn't act as a bank in that regard, they are only a payment provider and use their banking license for other things. So the two are separate and that means that even though it looks like a positive example in this regard at first, Paypal isn't really because the requirements for payment providers are very different. I'm curious to hear what you think about this topic. What's your experience with your bank? How do you do your banking? Is there an important angle that I missed? I appreciate any feedback. Happy hacking! Florian -- Florian Snow - Free Software Foundation Europe e.V. Schönhauser Allee 6/7, 10119 Berlin, Germany Registered at Amtsgericht Hamburg, VR 17030 Your support enables our work (fsfe.org/join)

11 16

Nominate candidates for the F-Droid board
by Matthias Kirschner 29 Feb '24

29 Feb '24

Hello all, Do you want to help advance mobile device user freedom? If so, please nominate candidates by 19 March for the F-Droid board of directors. The current developments around the mobile app stores of Apple and Google make this is an incredibly important time to get involved! https://f-droid.org/2024/02/28/help-advance-mobile-device-user-freedom-nomi… Transparency: I am a current member of the F-Droid board of directors. Best regards, Matthias -- Matthias Kirschner - President - Free Software Foundation Europe Schönhauser Allee 6/7, 10119 Berlin, Germany | t +49-30-27595290 Registered at Amtsgericht Hamburg, VR 17030 |(fsfe.org/support) Contact (fsfe.org/about/kirschner) Weblog k7r.eu/blog.html Ada & Zangemann - A Tale of Software, Skateboards, and Raspberry Ice cream - For everyone from 6 - 106 years - ada.fsfe.org

1 0

KDE community Plasma 6 megarelease | Celebrations in the coming weeks
by Joseph P. De Veaugh-Geiss 22 Feb '24

22 Feb '24

Dear FSFE Community, over the next several weeks KDE will celebrate the KDE community's Plasma 6 megarelease in locations around the globe. https://community.kde.org/Promo/Events/Parties/KDE_6th_Megarelease Celebrations are planned at the following locations, among others: - Málaga, Spain (26 February) - Budapest, Hungary (28 February) - Nürnberg, Germany (29 February) - Cambridge, UK (29 February) - Berlin, Germany (1 March) - Barcelona, Spain (2 March) - Ljubljana, Slovenia (4 March) - Montréal, Canada (8 March) - Valencia, Spain (sometime in May) If you are a KDE user, or you are a Free Software enthusiast and you want to show support for the work of the KDE community, it's be great to have you join us -- all are cordially invited! Take a look at the wiki link above for event details. And if you are KDE fan or community member/contributor, perhaps you would like to organize a megarelease party yourself? Don't hesitate to be in touch with me or the KDE community for organizational support. Cheers, Joseph Links: "Exploring Plasma 6", Linux Magazine: https://www.linux-magazine.com/Issues/2024/280/Plasma-6 "Introducing the KDE Slimbook V, first laptop with Plasma 6", 22 Feb. announcement: https://discuss.kde.org/t/introducing-the-kde-slimbook-v-first-laptop-with-… "This week in KDE: Inching closer", blog post Nate Graham: https://pointieststick.com/2024/02/09/this-week-in-kde-inching-closer/ "Support Plasma 6!": https://kde.org/fundraisers/plasma6member/ -- Joseph P. De Veaugh-Geiss KDE Internal Communications & KDE Eco Community Manager OpenPGP: 8FC5 4178 DC44 AD55 08E7 DF57 453E 5746 59A6 C06F Matrix: @joseph:kde.org Generally available Monday-Thursday from 10-16h CET/CEST. Outside of these times it may take a little longer for me to respond. KDE Eco: Building Energy-Efficient Free Software! Website: https://eco.kde.org Mastodon: @be4foss@floss.social

1 0

Please send your Router Freedom photo for the FOSDEM presentation
by Nico Rikken 27 Jan '24

27 Jan '24

Hi FSFE-community, Please send me a photo 📸 of your router of choice in operation, instead of the one provided by the internet provider. 🙏 I'd like to create a compiliation slide at FOSDEM to illustrate Router Freedom. Ensure there are no personal details on it and the photo is well-lit. 💡 Please add "CC0" in the text to signify you don't impose requirements on the use like attribution https://creativecommons.org/public-domain/cc0/ I can see us use the compilation at FSFE in the future as well. Lucas and I will be presenting on Sunday: https://fosdem.org/2024/schedule/event/fosdem-2024-3315-digital-services-in… You can order stickers here https://fsfe.org/contribute/spreadtheword.en.html#device-neutrality to decorate your router. Thank you, Nico Rikken Coordinator Netherlands

1 0

eIDAS 2.0 directive and free Android variants
by Mateusz Jończyk 16 Jan '24

16 Jan '24

Hello, I would like to point to a particular problem with using free software variants of the Android operating system (LineageOS, etc.): namely proprietary apps that detect if the phone's software is modified (by rooting or installing custom ROMs) and then refuse to run if it is so. Google makes this easy with its DRM mechanism called Google Play Integrity. This is particularly problematic with software that is important in daily life, for example banking [1] and government-provided apps. For example, Polish mObywatel and Ukrainian Diia belong to this category. These apps are published by the respective governments and used for increasingly many government-provided services. They refuse to work on LineageOS. Recently, the proposed version of the eIDAS 2.0 directive seems to require such behavior of government-issued ID apps. I hope that there is still time for some advocacy work to revert such changes. I am afraid that this problem will get worse with time as more people will be forced not to root their phones. Because of that, rooted phones will get less frequent and it would be easier for app developers to justify blocking them. Reversing this situation would then be difficult. This is going to kill in practice what remains of open source in Android. Greetings, Mateusz Jończyk [1] Reddit thread: Safety Net is making it harder to use or advocate for LineageOS, https://www.reddit.com/r/LineageOS/comments/sa3qkq/safety_net_is_making_it_…

3 3

Council of Europe's IT is on Microsoft
by Bernhard E. Reiter 12 Dec '23

12 Dec '23

Hi, looking through some public tenders, I found one [1] from the Council of Europe and their "development kit" says: The application back-end is built in .NET Core SQL Server 2019 must be used for development purposes. from DGA/DIT/DTK(2023)07 [2] which states This document presents the Developer's Toolkit, which defines the technical requirements for application development at the Council of Europe's Directorate of Information Technology (DiT). so we get some insights in the IT environment in this institution (which is seperate from the EU). They use Microsoft's products and the desktop, the servers and the cloud, and applications can only be developed using those tools. While .NET Core and its compiler and VSCodium ware meanwhile Free Software, the database is proprietary. Bernhard [1] https://www.coe.int/en/web/portal/-/31-january-2024-2023/ao/93-development-… [2] COE_DEVELOPER_TOOLKIT.pdf https://rm.coe.int/8-coe-developer-toolkit/native/1680ada90e -- FSFE -- Founding Member Support our work for Free Software: blogs.fsfe.org/bernhard https://fsfe.org/donate | contribute

1 0

Your thoughts about RCS: an open standard in proprietary hands to replace SMS
by André Ockers 08 Dec '23

08 Dec '23

Dear members of the FSFE discussion list, Please allow me to share a concern of mine. A business initiative of Google, supported by Apple, is Rich Communication Services (RCS), an open standard to replace SMS [1] [2] [3]. Questions that I have: - Would it be a smart and wise decision to let a non-European business take control over replacing SMS? - Would it be a smart and wise decision to break SMS as a general accessible service? - What would consequences be for Free Software, the privacy and consumer rights of us Europeans, and the environment? Best regards, -- André Ockers Member, Free Software Foundation Europe discussion list Blog (Dutch) | http://o7s.eu Blog (English) | http://en.o7s.eu Diaspora | https://diasp.eu/i/bf035797fa6c Mastodon | https://hostsharing.coop/@ao GnuPG public key | 0xE5A985A4D29A2E80 Steun de FSFE en bescherm uw vrijheid! | https://my.fsfe.org/donate [1] https://en.wikipedia.org/wiki/Rich_Communication_Services [2] https://www.heise.de/news/Google-gibt-nicht-auf-RCS-Messenger-mit-neuen-Fun… [German] [3] https://www.security.nl/posting/820331/Google%3A+SMS-vervanger+RCS+bij+ %C3%A9%C3%A9n+miljard+Androidgebruikers+ingeschakeld [Dutch]

3 2

Youth Hacking 4 Freedom open for registration
by Bonnie Mehring 28 Nov '23

28 Nov '23

Dear Discussion-List, Today, we would like to share the news about the start of the third round of Youth Hacking 4 Freedom (YH4F) with you. YH4F is a hacking competition for teenagers from Europe, regardless of their coding skills. YH4F is open to everyone between 14 and 18 years. The 6 winners will be awarded with a cash prize, in total more than 10,000 Euro. With YH4F, the Free Software Foundation Europe lowers the barrier for teenagers to engage with Free Software. YH4F provides the perfect entry point for teenagers to get in touch with Free Software. Participants get to practically experience the four freedoms. They develop their own Free Software project or contribute to an existing one, learning more about collaborative work in Free Software and Free Software communities. And, of course, fun is an essential part of the experience! The competition is about to kick off with an opening event on the 7th of December, 19:30 CET for all interested teenagers. In this event, we will share all the information about YH4F 2024 and of course answer all the questions participants might have. On the 1st of January 2024 the competition will properly start with the coding period till the 30th of June 2024. During this six month coding period participants will work on their Free Software project. Every month of the coding period, we organsie a monthly online meeting, in which the teenagers get to know each other and can form friendships across Europe. During these meetings, we, as well as jury members, provide input on Free Software topics. YH4F 2024 in a nutshell: * Participants must be between 14 and 18 years old at the time of registration. * Participation is free, but registration is mandatory. Registration is open throughout the coding period. For registering please share this link: https://survey.fsfe.org/index.php/658534 * The opening event is on 7 December 2023 * The coding period is between 1 January and 30 June 2024. * During the coding period participants are free to join the monthly online meetings. * The first-, second-, and third-place winners will receive €4,096, €2,048, and €1,024. There will also be three special prizes of €1,024. Overall, around 10,000 Euro will be awarded. * Each participant, who submitted a project will also receive a certification of participation and a special prize The competition will be conducted remotely, except for the award ceremony, which will take place in Brussels during a weekend in October 2024 (to which the winners and a family member will be invited on an all-expenses-paid basis). You can find out more about the FSFE’s coding competition here: https://fsfe.org/news/2023/news-20231116-01.html and on https://yh4f.org Please share this information with teenagers, teachers, organisations, youth clubs and others within your network and be part of YH4F 2024! If you have any questions please feel free to reach out to us at any time. Best regards, Alex and Bonnie -- Bonnie Mehring - Project manager - Free Software Foundation Europe Schönhauser Allee 6/7, 10119 Berlin, Germany | t +49-30-27595290 Registered at Amtsgericht Hamburg, VR 17030 |(fsfe.org/support)

2 2

[Grants | NGI zero] Open calls for free software, hardware and data activists with a FOSS project
by Xavier Coadic 13 Nov '23

13 Nov '23

Hello from somewhere in the EU, There is currently a call for projects to finance them (donations) which is open until 1 December 2023. This could be of interest to you or even help your friends to finance their work and development. Project funding available varies from 5,000 to 50,000 euros (with the possibility to scale them up if there is proven potential) Full summary is here: https://www.apc.org/en/news/open-calls-free-software-hardware-and-data-acti… A consortium of 12 non-profit organisations is involved in managing the NGI zero programme. https://nlnet.nl/entrust/background/#organisation 2 Tracks: + NGI Zero Entrust: Trustworthiness and data sovereignty https://nlnet.nl/entrust/guideforapplicants/ + NGI Zero Core: Moving the internet forward https://nlnet.nl/core/guideforapplicants You don't need to reveal your real name prior to the project being granted. Also, young people that have not yet reached the age of legal consent in their country of origin on the date of the deadline can also apply without any constraints. If you are based outside the European Union and still have doubts, please write to hvale(a)apc.org As well as funding from donations, there is specific support (technical, safety, accessibility, licensing, etc.) for the projects selected. Also, if you'd like to talk about it with me, I'd be delighted ;-) Warm regards, -- Xavier Coadic Association for Progressive Communications Communications associate for NGI Zero initiative

1 0

← Newer
1
...
5
6
7
8
9
10
11
...
328
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

2001

2000

Discussion