Bonum Certa Men Certa

Librethreat Database

Summary: malware-threat-like database of threats to libre software (especially those that can be used to compromise software itself)

Tivoisation

  • Threat type: License circumvention
  • Affects: Devices, copyleft
  • Recognised by: Most free software advcates
  • Also recognised by FSF: Yes
  • Summary: GPL2 not strong enough to prevent DRM/TPM from allowing device owners to change operating system in devices
  • Mitigation: Migrate to GPL3
  • Examples: Tivo


  • Cloud

  • Threat type: Hybrid (Marketing, Technology category)
  • Affects: Privacy, freedom, control by the user
  • Recognised by: Many
  • Also recognised by FSF: Yes
  • Summary: There is no cloud, only someone else's computer (so you have no control over your computing)
  • Mitigation: To be very sceptical of / avoid relying on / boycott "cloud" solutions
  • Examples: Adobe, Delete Github|Microsoft Github, countless others


  • Punix

  • Threat type: Broad category
  • Affects: Free software development, stability and reliability, autonomy, organisational structure
  • Summary: EEE of free software projects, Infiltration of organisations that offer free software
  • Recognised by: freelabs federation
  • Also recognised by FSF: Not officially, at least
  • Mitigation: PONIX! Also avoid / fork / replace / document examples of Punix in software, assist Hyperbola and Guix developers
  • Examples: Pending


  • Redix

  • Threat type: Broad category
  • Affects: Free software development, stability and reliability, autonomy, organisational structure
  • Summary: Disruption of POSIX, EEE of free software projects, Infiltration of organisations that offer free software
  • Recognised by: freelabs federation, some critics of Systemd
  • Also recognised by FSF: No
  • Mitigation: Avoid / fork / replace / document examples of Redix in software, use Systemd-free distros, assist Hyperbola developers
  • Examples: Pycon, Systemd


  • Infinite scrolling

  • Threat type: Semi-malicious UI design
  • Affects: Mostly websites, Server-side software
  • Summary: Deliberately addicitive design not only psychologically manipulates user to keep scrolling, also makes it difficult to navigate pages or reach bottom of page (when there is one.)
  • Recognised by: Advocates of users, good design, ethics
  • Also recognised by FSF: Unknown
  • Mitigation: To boycott / avoid webpages that use infinite scrolling, create plugins that turn high-profile pages that use it into pages / demand old-fashioned paging as option from webmins
  • Examples: Twitter, wordpress.com (includes some limited mitigation/option), Diaspora, many others


  • Gratuitous interdependency

  • Threat type: Semi-malicious design attack / development disruption
  • Affects: Existing modularity, user freedom, free software development / packaging / vital software that lots of people rely on
  • Summary: Grab lots of stable projects and deprecate/rework them into something more monolithic / EEE design tactics
  • Recognised by: Steve Litt, freelabs federation, some critics of Systemd
  • Also recognised by FSF: Very unlikely (or in very limited/historical context)
  • Mitigation: Avoid / boycott / document / stand against projects that use EEE-like tactics against high-profile free software projects
  • Examples: Systemd, PulseAudio, GNOME (GNOME does not strictly depend on Systemd, these are three separate examples)


  • Framework attack

  • Threat type: Semi-malicious design attack / development disruption
  • Affects: Free software development / UX / UI, sometimes for years at a time
  • Summary: Replace mature and stable framework with new shiny and send devs scrabling to make reliable software work again
  • Recognised by: Steve Litt, freelabs federation
  • Also recognised by FSF: No (except when the framework is non-free, of course)
  • Mitigation: To be sceptical of unnecessary framework replacement, to maintain forks (if possible) of versions with old framework until new one is reliable / maintain LXDE
  • Examples: Systemd, LibreOffice, LXQT (non-malicious example, can't blame them for not wanting GTK3)


  • Framework / dependency hijacking

  • Threat type: development disruption
  • Affects: Free software development, stabilty, UX / UI, sometimes for years at a time
  • Summary: Similar to framework attack, except that happens from inside a project and this happens upstream
  • Recognised by: Anybody that doesn't like GNOME, people who prefer GTK2, Python2 users
  • Also recognised by FSF: No (except when new versions of the framework become non-free, of course)
  • Mitigation: Modest or conservative dependency usage / minimal design / design that is compatible with at least 2 or more frameworks, choice of two default configuations (one that gets as close as possible to the previous version to allow smoother transition)
  • Examples: GTK3, Themed applications


  • https://framasphere.org/uploads/images/scaled_full_1033d2f64866dafcd9b7.png

    Code of Conduct

  • Threat type: development disruption, social
  • Affects: communication, software development, organisations
  • Recognised by: Some free speech advocates, some free software advocates, freelabs federation, Eric S. Raymond
  • Also recognised by FSF: Not necessarily (though the KIND guidelines suggest a possibility)
  • Summary: Can be abused to stifle and silence important feedback
  • Mitigation: Adopt more reasonable version, avoid altogether, address same problems that CoC aims to, but with more allowance for free speech and diversity of opinion
  • Examples: FreeBSD Code of Conduct


  • Bigotry, hate, discrimination

  • Threat type: development disruption, social
  • Affects: communication, software development, organisations
  • Recognised by: freelabs federation, Most free software advocates
  • Also recognised by FSF: Yes
  • Summary: Can silence important feedback or punish/hurt people just for their differences
  • Mitigation: Work together to help prevent and counteract discrimination
  • Examples: insisting any gender is ill-suited to coding or technology use/creation, harassing people for being trans


  • AI-assisted software engineering

  • Threat type: Design attack/ design disruption / highly speculative
  • Affects: Security, maintainability, human software development
  • Summary: If AI is already being used to cut corners in engineering, it can be used to plan and assist the implementation of disruptive software redesign-- key points of stability can be determined and undermined, AI could be used to introduce weaknesses in overall design as well as code
  • Recognised by: Science fiction authors, perhaps
  • Also recognised by FSF: Not yet
  • Mitigation: Not much needed, it is largely hypothetical and proposed as a thought experiment-- it would be interesting though, for someone to create an AI that invents scenarios that threaten software freedom
  • Examples: only hypothetical ones-- suppose you had AI map out a software project as a video game, and then wanted to introduce "baddies" that gradually overwhelm developers-- AI can be used for planning, it can be used to drive enemy characters, it should be possible to use it for creating subtle and increasing disruption in software development http://www.primaryobjects.com/2015/11/06/artificial-intelligence-planning-with-strips-a-gentle-introduction/


  • Co-opting charities

  • Threat type: Development disruption, social
  • Affects: Communication, software development, organisations
  • Summary: Some FLOSS-related and non-free software-related companies have complementary non-profit and commercial organisations; that isn't the problem, though it is a problem when the co-opt charities to promote non-free software
  • Recognized by: Techrights, some public schoolteacher/activists, freelabs federation
  • Also recognized by FSF: At least as much as you would expect
  • Mitigation: Avoid / boycott / document / stand against projects that use EEE-like tactics combined with public charity organisations
  • Examples: Influence and changes in both public education and OLPC


  • Apathy

  • Threat type: Development disruption, social
  • Affects: Communication, software development, organisations
  • Summary: Deface Wikipedia, get called a bastard; but deface free software projects and take over related organisations, get named a "contributor" and people saying "it's not our problem"-- as the problems get larger, why are advocates getting quieter?
  • Recognized by: Techrights, freelabs federation, most likely some people from Dyne or Devuan also
  • Also recognized by FSF: To be determined
  • Mitigation: Avoid / boycott / document / stand against projects and companies that use EEE-like tactics against high-profile free software projects and organisations
  • Examples: Systemd, Many free software advocates


  • Appliance-like Distributions

  • Threat type: Hybrid (technical restriction, design disuption, marketing, oem abuse)
  • Affects: Security, maintainability, privacy, freedom, control by the user
  • Summary: Some distros seem to be designed with building more restrictions into the user experience as a priority-- making GNU/Linux better simulate or act as a non-free platform. "Distros like this are the killshot for GNU/Linux, the triumph of Open Source over freedom" -- Ted MacReilly
  • Recognized by: freelabs federation
  • Also recognized by FSF: Yes, to the degree that they include non-free software
  • Mitigation: AVOID platforms that are more locked down than traditional GNU/Linux, document restrictions inherent and endemic to those platforms, encourage people to mitigate those restrictions and remove compromised features (F-droid, AOSP, Android without Google)
  • Examples: Chrome OS, Endless OS, Android, Elementary OS


  • Digital Restrictions, other malware in kernel

  • Threat type: Technical restriction, design disuption
  • Affects: Security, privacy, freedom, control by the user
  • Summary: Handing control of the Linux kernel over to compromised developers could result in anti-features
  • Recognized by: freelabs federation, Techrights, others
  • Also recognized by FSF: One would hope they would treat fixing this as a priority if it happened
  • Mitigation: Reject DRM in other products to show a firm stance from users, expand Linux-libre scripts to remove Digital Restriction Malware
  • Examples: proposals for DRM in Linux kernel already exist


  • GNOME

  • Threat type: Treacherous Anti-Free-Software organisation
  • Affects: Security, freedom, design
  • Summary: Corruption among high-profile people in GNOME so extensive, sustained that it should be considered a feature
  • Recognized by: Who agrees?
  • Disputed by: (let us know)
  • Also recognized by FSF: No, but Stallman did call de Icaza a traitor
  • Mitigation: Reduce reliance on software from GNOME, Examine corruption endemic to the project, Fight systemd, Make people more aware of the history of GNOME abuses, Reinstate Stallman, Kick GNOME out of the GNU project, Kick corrupt people out of GNOME.
  • Examples: Supporting and promoting Mono, de Icaza's treachery and defecting to Microsoft, Stormy Peters defecting to Microsoft, de Blanc's conflict of interest (OSI, Debian) creating systemd dependencies, taking money for "defending" from patent attacks in a way that harms GNOME and Free Software simultaneously.
  • More information: https://debian.community/mollamby-conflict-of-interest-privacy/ https://debian.community/fragmentation-and-maturity-in-debian/ https://debian.community/feed.xml


  • Clickbait defamation

  • Threat type: Social, Economic, Organisational
  • Affects: Organisational stability, social standing of developers and free software leaders
  • Summary: Mainstream media (MSM) attacking free software developers and leaders with a very modern attack based on the contemporary ways in which consumers read and share news stories; deliberate dishonesty is a key factor
  • Recognized by: Lawrence Lessig, freelabs federation
  • Also recognized by FSF: At least a small but significant part of it
  • Mitigation: at least boycott sources that use Clickbait for character assassination and to imply things that would traditionally set off a defamation suit if said outright
  • Examples: Forbes, Vice coverage of rms in 2019


  • Malicious hardware and firmware

  • Threat type: Design attack / development disruption
  • Affects: User freedom, free software development, security
  • Summary: Harmful features that affect the user even if they reinstall the operating system
  • Recognized by: Techrights, Mark Shuttleworth, freelabs federation, free software advocates
  • Also recognized by FSF: Yes
  • Mitigation: Avoid / boycott / research / modify / document such hardware
  • Examples: Lenovo firmware payloads, ACPI vulnerabilities and exploits


  • Academia

  • Threat type: Hybrid (Surveillance, Marketing)
  • Affects: Privacy, freedom, control by the user
  • Recognised by: ?
  • Also recognised by FSF: ?
  • Summary: Modern universities have unethical practices that include requiring students to install malicious and privacy-destroying software on their PC's.
  • Mitigation: Find universities that don't use this software; replace academia with something that actually respects human rights
  • Examples: > 1000 campuses across the world and growing


  • NOTE:

    The four freedoms allow unrestricted modification and redistribution of software.

    This database is not about making the 4 freedoms invalid or less important.

    This database is a list of attacks that could be used to disrupt or lower the quality of existing free software projects (Distributions, high-quality applications, organisations, and user freedom that is more abstract than the 4 freedoms.)

    These attacks are not always a threat-- they depend on context and the level of mitigation. Being able to change and redistribute (and sometimes choose alternatives to) the software is a requirement for mitigating these attacks, but there is a categorical difference between "the problem can be solved because the source is right there" and "the problem does not exist." It exists until you can actually solve it, of course-- and until you or someone actually does.

    Licensing cannot mitigate all of these attacks, because to try to mitigate all of these attacks in the license would interfere/clash with the 4 freedoms necessary to be a free software license.

    These attacks can only be mitigated by the cost of freedom itself: eternal vigilance, free and open debate, plus educated, well-informed users. It also requires understanding and integrity on the part of developers.