[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: [Prepare mass bug filling][RFC] New lintian tags: privacy-breach



hello debian developers,
hello trademark team,

(trademark team tl;dr: how's the incoming trademark policy going? having
trademarked and copyighted logos around is an issue again.)

i'm hooking into this topic with another aspect of it, attempting to cut
the "let's just ship the icons"-sayers with what has already been said
and done on the topic.

On Mon, Dec 23, 2013 at 04:23:19PM +0100, Bastien ROUCARIES wrote:
> I plan to mass bug the concerned package.
> 
> They are some pattern in the privacy breaking website:
> - Valid html icons (w3.org). This one is problematic because we could
> not carry the icons in our tree (icons are not modifiable thus not
> free). Do we have an alternative ?
> - [...]
> - donation website. This one is problematic. I consider unethical to
> strip completly the donation part on the documentation. Free software
> need money. But I consider unethical to track our user. Thus I
> personnaly think documentation in this case need to redirect (but
> asking for a user click and by loudly noting that user will be
> redirect to external site) to upstream website. I need some comment on
> this

some software avoids this by shipping copies of nonfree logos, [1] can
be an example, as are various search engine logos. (this is not reported
yet for it would be another mass filing, see `apt-file find acebook
 |grep 'gif\|png'`).

this is especially the way to go for programs which don't serve them via
a web server, but use the images locally (to represent accounts (instant
messengers), or for donation buttons in the about dialog).

i don't have any plan for action on how to resolve this in general;
there are two directions i see, both of which should be followed:

* some owners of logos will be cooperative. in the case of flattr (which
  was what got me involved via the openscad package), i received a
  statement from the flatr bigboss amounting to "we can work it out,
  what do you need?". afaict, there is an ongoing work on an "incoming
  trademark policy", the idea being that logo owners could release the
  logo under a permissive licence while simultaneously restricting
  misrepresenting modification by a trademark policy.

  i don't know how much progress there has been in that area. in my
  ideal world, there'd be a document from debian, similar to the
  upstream guide, explaining to willing upstreams how they can release
  their logo files while protecting their brand (which they might be
  even legally bound to), but to the best of my knowledge there isn't
  yet.

* we can establish a way of working around the problem technically. that
  might involve a nonfree "logos-various-internet-services-nonfree", a free
  "logos-various-internet-services-imitations" and a free
  "logos-various-internet-services-free", where
  
  * -nonfree contains icons of google, yahoo, flickr etc in all the
    common resolutions; possibly, it'd be an installer package
    (downloading the icons at install time if we can't ship them even in
    nonfree).

  * -imitations contains remakes of them (eg a plain white f on blue
    background)

  * -free contains icons that are usable in debian

  when someone needs another icon, he can submit it for inclusion in
  -nonfree and design a workaround for -imitations. further steps with
  the icon upstreams coud then make the icon migrate to -free. a symlink
  farm (possibly alternatives-based) can take the load of dealing with
  this off the package, which only needs to +dfsg-repackage the software
  and {install a symlink instead of the image,bend the image path} and
  depend on something that provides logos-various-internet (>= when the
  icon was added <= major release we reserve to drop icons of dead
  services).

  i'd prefer an easier technical solution if there were one.

for further reference, this issue has also come up with ikiwiki[2].

did i miss an easy solution? what can affected packages actually do?

best regards
chrysn

[1] http://sources.debian.net/src/trac-authopenid/0.4.1-2/authopenid/htdocs/images
[2] https://ikiwiki.info/bugs/do_not_let_big_brother_spy_on_our_users_on_login/

-- 
A beginning is the time for taking the most delicate care that the balances are correct.
  -- Princess Irulan, Manual of Muad'Dib

Attachment: signature.asc
Description: Digital signature


Reply to: