Social engineering attack: Debian voted to trick you on binary blobs
07:30 Thu, 23 Oct 2025
Reprinted with permission from Daniel Pocock.
Many people expressed mild dismay about the 2022 vote to allow binary blobs in the Debian installer.
Few people, if any, commented on the trick: they have used the term "non-free" to refer to these blobs.
This is another social engineering attack in broad daylight.
In the Debian world, to classify software as non-free, it still has to provide all of the source code. The term non-free tells us that there is something awkward about the license for that source code but when you see the term non-free, you know the source code is there.
From the Wayback machine snapshot of Debian web site in 1997:
Packages in this directory do not necessarily cost money, but have some onerous condition restricting the redistribution of the software.
Yet if we look at the Debian policy manual today, we find the thin end of the wedge:
It is possible that there are policy requirements which the package is unable to meet, for example, if the source is unavailable. These situations will need to be handled on a case-by-case basis.
The text of the policy manual has been softened up so that somebody with enough power, like an FTP Master, could slip something in under the radar. Remember the concerns expressed by AJ Towns about giving too much power to one person? Does his client exert pressure on him to take shortcuts when necessary to ensure their flights stay on schedule?
Non-free licenses typically have some clauses in them that allow us to redistribute the source code but they make some limit on how the code can be used. For example, the very famous case of the original JSLint license, containing the clause "The Software shall be used for Good, not Evil." is a non-free license. However, the JSLint developers always provided one hundred percent of the source code.
The community has accepted the definition of non-free over three decades. Yet since the vote in 2022, people are using exactly the same term, non-free, to refer to something that is even less free than non-free.
They softened us up to the term non-free over thirty years. The 2022 general resolution vote allows them to use our understanding of the term non-free to exploit us and give us something other than what we came to expect from that term.
IBM Red Hat very explicitly told people that RHEL source code can't be distributed any more. The wording of the Debian general resolution sent us down the same path by stealth.
To put it another way, they voted to broaden the definition of non-free so the term no longer has any value at all.
We saw the same phenomena with the word "harassment". They now use the word "harassment" to describe anything they don't agree with. When competent professionals ask urgent questions about the social engineering attacks, the misfits cry "harassment" to avoid looking us in the eye.
Leaked debian-private archives give us many insights into how the Debian founders put great thought into the meaning of these words.
Remember, they spent over $120,000 on legal fees to argue about the trademark. Why didn't anybody defend the real meaning of the non-free trademark? For many users, the non-free trademark is far more important than nit-picking about pronouns.
Please see the chronological history of how the Debian harassment and abuse culture evolved. █