Bonum Certa Men Certa

Microsoft GNU-Hub (Part 1)

Guest post by figosdev

GNUHub

Summary: Any project of GNU going into GitHub is making it seem or feel acceptable for GNU projects to be 'outsourced' to Microsoft; so what does it mean to have some of GNU inside the proprietary software jail of Microsoft? The first part deals with GNU projects that have GitHub dependencies.

Microsoft's takeover of free software is fascinating, but where can the line be drawn? I treat this as both a hypothetical question and a practical one, because I've spent years boycotting Microsoft and ever since they purchased GitHub, I've noticed that's become next to impossible. "A source repo on every desk..."



Originally I thought perhaps we could boycott projects that are based on GitHub, since hey -- there's some cool stuff there but it's just some applications, right? Then I noticed full programming languages and libraries. Oh... Node.js, that sucks. CPython, oh well, there are other implementations. Perl, hmm...

Then I noticed several GNU/Linux distros volunteer to be captured by Microsoft. I mean I'm not going to be using those -- oh, it's a lot. I've already gone to the trouble of figuring out that out of 275 active distros on DistroWatch, if you really want to boycott GitHub you're down to at most, 33. No, not 33 percent -- 33 distros, including Tiny Core! Not including Trisquel. Trisquel is captive to an anti-GPL monopoly via its stupid, stupid "init" system. (Cuckoo OS, more like).

But we can always build our own distro, Eh? So let's take apart Tiny Core, I figured -- It's incredibly modular, it should be a piece of cake to remove the parts controlled by Microsoft, right?

"Microsoft has Gtk yoked by something glib2 needs."The kernel isn't libre, I know. I've wanted a linux-libre kernel (or at least a Debian blob-free kernel) for TC for ages. Maybe the blobs are in tcz packages. But I think if TC had a blob-free kernel it would be advertised as such.

I once hoped Alex Oliva would consider making a libre kernel for TC, but that's getting ahead of ourselves a bit. I've never been interested in maintaining a kernel, I only got into remixing distros because I wasn't paying attention.

I created scripts a year or two ago to remix Tiny Core and create tcz packages. They're basically squashfs files, which TC "installs" by mounting them. Ok, that's no big deal. Oh, development of squashfs-tools has moved to GitHub. Lovely. But the kernel portion is still developed where it should be. I take this as meaning that the Linux kernel can mount tcz, it just can't produce them. Ok, I guess we can use files that are mkfs'd to ext3 instead. That's a GitHub-free solution, we can worry about compressing them later.

What we really need to do is figure out what to remove, and that's going to take some research. I've already started figuring out which TC packages can be dropped.

Those red boxes are packages for things based on GitHub, but the gold boxes are packages that need things like libffi which is based on GitHub. Just so you know, libffi is pulled in by glib2. The GUI apps (Gtk at least) need libffi, so that's at least one serious "Gotcha" already. Microsoft has Gtk yoked by something glib2 needs.

I don't always trust Debian dependencies, but they're certainly illustrative -- here's the page for glib2: https://packages.debian.org/buster/libglib2.0-0 it needs libffi6. Oh, fun -- it also needs zlib1g. This is needed for loading png graphics, so anywhere you find a png, you need GitHub. No, this isn't because of glib2. Zlib1g is also developed on GitHub, and is needed along with libpng for loading or saving png graphics.

In the past, Microsoft has killed off lots of its acquisitions to hurt competitors, so the scenario I'm assuming is one where it decides to start killing (or taking over) free software projects it doesn't care about.

"There ought to be an exodus."When Oracle tried this with OpenOffice, the developers simply left and forked it. That's exactly what they should do, but in this instance, developers have loads of warning. And they're just sitting on Microsoft's repos like it's no big deal, letting their projects become further and further entrenched. I'm well aware of the fact that not everybody who develops on GitHub actually cares about software freedom. That's another reason not to develop there.

So imagine Microsoft forcing several such forks at the same time. Build systems for distros everywhere would be thrown into disarray. It's not that the scenario will necessarily be worst-case, but I expect Microsoft intends to get their money's worth. There ought to be an exodus.

If we are trying to escape, at least we can figure out where free software has its foot caught in a proverbial bear trap.

Libffi? Not good. Zlib1g and png graphics? Whoa, someone fix that. Lately I'm saving screencaps with JPEG in protest, which is certainly not ideal. The GIF patent has expired, but it only does 8-bit colour. I guess there's still X PixMap, right? We can do 24-bit graphics with xpm.xz (XZ-utils are not GitHub-based. I think they originated with a couple of Slackware developers.)

I've made my way from Tiny Core to Trisquel looking for GitHub vulnerable projects, and finally from Trisquel directly to the GNU project itself. It isn't good, folks.

This is Part 1, implying that there will be a Part 2 if not a Part 3, but I've only looked through a fraction of the GNU projects and here's what I've already found:

The GNU project uses Perl -- a lot!

"The GNU project uses Perl — a lot!"I don't compile a lot of programs, personally. I've spent hours editing and recompiling one C++ program, I've edited and compiled one minor C program, mostly I work with scripting languages (though I do use source-to-source compilers a lot).

If there are obvious mistakes or less obvious misconceptions I'm presenting when I talk about some of the details, I hope you'll mention it in the comments. I'm sure there will be a few differences of opinion as well.

But let's start with Automake. Automake is used for a large number of GNU packages -- it depends on Perl. Perl is on GitHub. That's not good, hackers -- that's not good.

Many GNU sources have a file called "missing" which I believe is Automake-related. This file often informs the user that they will need Perl (and links to perl.org so they can get it) and it links to flex on GitHub. There's another one. Of course some of the GNU sources are so old they still link to the flex on SourceForge. Here's a fun fact: GNU Savannah is a fork of SourceForge from when it was still free software.

Flex, lex, Yacc and Bison are all related -- lex is a lexer, flex is an alternative, Bison is an alternative to Yacc and Bison often uses flex to get tokens. The problem is that flex is GitHub-based. This is not good. Plus, Automake also wants flex. So whatever sort of creek we are in, our paddle is slowly transforming into a tiny little stick.

A lot of GNU sources include texinfo files. Texinfo seems to need Perl as well.

VERA includes a Perl script, vc-dwim is a Perl script (missing wants flex anyway) WB B-tree Associative Arrays seems to include C Sharp code (so you'll need Mono, which the FSF warned against and which is based on GitHub) XBoard uses png files, Xnee includes pnee which uses Gtk and png.

As mentioned, Gtk brings in glib2 which brings in libffi, which is based on GitHub -- while Gtk2 and Gtk3 are not based on GitHub, if you're looking for Gtk1, GitHub is where it appears to be.

Some of these old GNU programs appear to use Gtk1, so whether each one is GitHub-based because of libffi or GitHub-based because of Gtk1, is a detail I've mostly ignored.

Units includes units_cur which is a Python script and texi2man which is a Perl script.

"Texinfo seems to need Perl as well."The thing about Python is that CPython is the most often-used implementation, including in the GNU project, and CPython is based on Microsoft GitHub. PyPy is a great drop-in replacement, though it doesn't work on everything.

You can't always tell when you find yourself in front of a Python script, whether it needs CPython (thus GitHub) or not. So Python is worth watching for, but only proves to be a GitHub hostage sometimes.

Taylor UUCP uses Perl, Tex for the impatient uses png files in docs, Texinfo uses Perl, Hurd includes gitlog-to-changelog which calls Perl, GNU Readline includes texi2html and texti2dvi, which use Perl.

GNU Shepherd has png files in /doc and perl and flex in missing. Gnu Telecom has a png file. Sather has a Perl script called ps2gif. Spread Sheet Widget uses Gtk, SQLtutor has pngs in the docs. Swbis appears to need Python and python-devel.

Queue is dumped in favour of GNU Parallel, which uses Perl. Ring redirects to GNU Jami, which uses Python.

PythonWebkit obviously needs Python; pyconfigure may get away with PyPy as a replacement. PSPP uses Perl and png files with a GUI in Gtk. Proxyknife has Perl code in the docs and in configure.

Doxyfile is one to watch for in the sources. I believe this is created by Doxygen, which is used to created documentation from source code. Doxygen is based on GitHub.

PowerGuru has a png and lots of Python code, oleo has png in docs and uses plotutils, which support png. Ocrad has a png in /archive. Occhiolino uses Python. MetaHTML uses perl.h.

Mac Changer hasn't updated in years, but like GNU Radio is a GNU project that's based on GitHub -- really not good. I can't figure out why GNU Radio hasn't tried to move though. That still gets worked on, unlike Mac Changer.

GNU LibreJS, a tool I cheered on for ages waiting for it to be created, uses Jasmine, a Javascript library which is based on GitHub: http://git.savannah.gnu.org/cgit/librejs.git/tree/build.sh

In fact build.sh downloads it directly from Microsoft, which I think shows a bit too much trust given that this plugin goes directly into GNU IceCat:

JASMINE_URL="https://GitHub.com/jasmine/jasmine/releases/download/v$JASMINE_VER/jasmine-standalone-$JASMINE_VER.zip" curl -L -o "$JASMINE_LIB.zip" "$JASMINE_URL" && unzip -d test/ $JASMINE_LIB.zip lib/**

We've all done something like this, but this is exactly where it shouldn't be done.

Make also seems to need Perl, it may or may not need Python.

"The FSF already warns people against non-free repos such as GitHub. While self-hosting is certainly better, many people won't and my advice to them is at least choose a non-profit organisation for hosting their code."This only covers a portion of the GNU project, but let's tally up what needs to happen for the GNU Project to not rely so heavily on the good will of its most dedicated foe:

1. Fork or make an official GNU mirror of Perl. If Perl goes, GNU is just about done.

2. The same applies for zlib1g as well. This library was invented and/or promoted specifically to avoid GIF-related patent traps! Now it's controlled by the world's second-biggest patent troll (the other sponsors the FSF. Great.)

3. Figure out libffi. I can't tell you more, I only know it helps things like Python use things like ctypes ("foreign functions").

4. Start using PyPy more, when possible. CPython is a trap. Note that PyPy has some major limitations. I'm very fond of it, any limitation it has I'm hoping for the best.

5. Write something justifying support of Mono in WB B-tree Associative Arrays. I would suggest removing that part of the code, but that seems unlikely.

6. That LibreJS code could be fixed today. At least mirror Jasmine in the LibreJS tree.

7. The FSF already warns people against non-free repos such as GitHub. While self-hosting is certainly better, many people won't and my advice to them is at least choose a non-profit organisation for hosting their code.

Gitea is also developed on GitHub, so it's a bit odd that they're touting it as an alternative. If it's an alternative, why not move Gitea off GitHub then? (at least move it to GitLab).

I never did trust Google Code, of course. For-Profit code repos technically have the same problem that GitHub has: they can be bought just like GitHub. Non-profits have to be infiltrated like the FSF or FSFE instead, which is harder.

"What's lacking now is leadership, and though I think it would take more than putting Stallman in charge again (which is the right thing to do as the efforts to remove him were dishonest and corrupt, plus it would probably help) there doesn't seem to be anybody who is doing a better job."A decentralised, peer-to-peer means of hosting would be ideal, though currently the main project I know of related to hosting code that way is through feneas.org, which I already associate with the typical trend of Codes-of-Censorship (along with a "FOSS" manifesto which combined with their Code of Conduct is ultimately going to lead to a hardline, de facto "be nice to the Open Shills" policy. It's not like there aren't precedents.

Don't get me wrong, so far the software looks good. But you can say the same for the GNU Project.

The importance of leaving GitHub is really not stressed enough by what's left of the Free Software Foundation.

What's lacking now is leadership, and though I think it would take more than putting Stallman in charge again (which is the right thing to do as the efforts to remove him were dishonest and corrupt, plus it would probably help) there doesn't seem to be anybody who is doing a better job.

Unless "better" means "bigger events funded by Microsoft and Google". No thanks, the Linux Foundation was doing that already, and it didn't help at all.

Long live rms, and happy hacking.

Licence: Creative Commons CC0 1.0 (public domain)

Not including the code snippet, which is from http://git.savannah.gnu.org/cgit/librejs.git/tree/build.sh

And if this article uses a parody of the GitHub logo based on the GNU head, I almost certainly used this one from Wikipedia.

Comments

Recent Techrights' Posts

Coping With the Site Going More Mainstream
Fame is no laughing matter
Generation Chaff - Phase V: Censorship of Dissent (Painted as Harassment or Terrorism)
Censorship is all around us now
Generation Chaff - Phase IV: Apps Only Few Companies Decide On
Tools are being collectively confiscated, under the premise or false prospect of "security"
Why We Support Richard Stallman and You Probably Should Too
It's not about being "Richard Stallman fan", it is about maintaining the right to hold positions (on technology) like his
Some Large German Media Covers Richard Stallman's Talks in Germany Earlier This Week
LLM-based chatbots are just "bullshit generators" (as he has long called them)
Trouble in Red Hat/IBM and a Retreat to Ponzi Economics in Search of Wall Street Market Heist
Would you invest your life savings in this kind of crap?
Who Asked Software in the Public Interest (SPI) for a Refund? ($100,000, Resulting in Losses of $267,201 in 12 Months, Highest-Ever Losses)
The IRS does not reveal who or what's tied to this refund (or the cause/reason)
 
They Never 'Put Down' Corporations
There are "pests" that are traded in Wall Street
21 Pages in Less Than 7 Hours is No Joking Matter
We've become a lot more effective and efficient
Correct Information is a Valued Asset in the Age of Slopfarms and Public Relations (PR) or Spin
Publishing suppressed facts is never easy
The Register MS Continues to Bag Money to Promote a Ponzi Scheme, Even Money From China
Today in the front page
analytics.usa.gov: The Only Supported Version of Windows (This Past Week) is Only Used by About 13.9% of People in the US, the Home Base of Windows
Even Vista 7 is still used more
Rust is Very Secure
If only Rust itself is secure
Who Will be Held Accountable for Breaking Ubuntu by Imposing Rust on Otherwise-Functional Programs, in Effect Replacing GNU With Proprietary Microsoft (GitHub)?
they're practical people who merely point out that a bunch of buffoons not only ruin Ubuntu but also every future distro based on Ubuntu
Generation Chaff - Phase VIII: In Summary
Like "Science" with a capital "S", what we see here commercial interests usurping everything
Generation Chaff - Phase VII: Curtailing Alternative Media
There was always an obligation - a collective duty of sorts - to uphold independent journalism
Generation Chaff - Phase VI: Centralisation of Information (X, Cheetok/Fentanylware)
Would you trust information when controlled by such people?
Generation Chaff - Phase III: Slop and Plagiarism
A lot of the current so-called 'economy' is built upon false valuations
Generation Chaff - Phase II: "Cloud", Blockchains and Other Hype
For those of us who turned down those propositions there was a struggle; we needed to justify not having skinnerboxes or "social" accounts in some site run by a private company
Generation Chaff - Phase I: Social Control Media
IRC predates the Web
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Thursday, October 23, 2025
IRC logs for Thursday, October 23, 2025
More Clues Shed on Collapse of Microsoft XBox
XBox is basically circling down the drain as Microsoft implements 2-3 waves of layoffs each month
'Vibe Coding' Doesn't Work
In a lot of ways, so-called 'Vibe Coding' is already considered vapourware or a passing fad promoted in the media by managers who try to justify mass layoffs, especially ridding companies of "very expensive" software engineers
Links 24/10/2025: Microsoft's Killing of XBox Connected to Revenue/Profit Problems, "How Elon Musk Ruined Twitter"
Links for the day
Gemini Links 24/10/2025: 86,400 Seconds and "Society's Task"
Links for the day
Slopwatch: Google News and Slopfarms That Relay Nonsense From LLMs
Google News, which once prioritised or used to care about provenance and quality, is feeding slopfarms
Links 23/10/2025: More Health Concerns Over Dumb Chatbots (LLMs) and "Talking Cars" as Latest Buzz
Links for the day
Gemini Links 23/10/2025: Daylight Savings Time and Duration Shorthand
Links for the day
Links 23/10/2025: LLM 'Hallucinations' (Defects) in Practical Code 'Generation', China Becomes More Economically and Technologically Independent
Links for the day
Linux Foundation Uses LLM Slop to Promote Microsoft in Linux.com (Again), Rendering It a Linux-Hostile Slopfarm
Openwashing with slop by "Linux.com Editorial Staff", which basically seems to be a bot
Links 23/10/2025: Windows TCO Galore and "The Internet Is Going to Break Again"
Links for the day
Social engineering attack: Debian voted to trick you on binary blobs
Reprinted with permission from Daniel Pocock
Techrights Will Always Stand for Women's Rights
We even invest money - personal savings that it - in our principles
Certified Lawyers Should Know Better (Than to Intimidate Us With Man Who Drives on Motorcycle Through a Really Bad Storm Between Distant Cities, Then Collects Photos of Our Home)
Mentioning someone was in prison for bad things isn't a crime, it's a public service
The "AI" (Slop) Bubble is Already Imploding
"ChatGPT Usage Has Peaked and Is Now Declining, New Data Finds"
The So-called "Sexy" Buckets (AI, Quantum) Cannot Save IBM From Reality, Shares Tank
"No matter how much financial hocus-pocus they use to reclassify revenues to land in the "sexy" buckets (AI, Quantum), it still smells old and musty - just like this company."
Paul Krugman is Wrong About the Scope of Mass Layoffs in the United States
A few years ago society was accelerating its journey towards feudalism, boosted by COVID-19
Links 23/10/2025: Proprietary Blunders and CISA's Latest Disclosure of Holes
Links for the day
Gemini Links 23/10/2025: Fast Past (F1), 99.9% Uptime
Links for the day
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Wednesday, October 22, 2025
IRC logs for Wednesday, October 22, 2025
Slopwatch: Google News is Promoting Fake 'Articles' About Fake Xubuntu, Fake Articles About Replacing Windows With GNU/Linux
The quality of the Web deteriorates and unless someone cleans up the mess, real sites will lose an incentive to produce anything
When "AI Layoffs" Mean Layoffs Due to the "AI" Bubble Popping
many people that are laid off by Microsoft claim to be specialists in "AI"
Mysterious grant forfeited, $100,000 from Software in the Public Interest accounts 2023
Reprinted with permission from Daniel Pocock
Evidence: bullying, student union behaviour: Armijn Hemel's FSFE resignation
Reprinted with permission from Daniel Pocock
Evidence: psychological abuse, stalking, Galia Mancheva, Susanne Eiswirt ignored by FSFE judgment for Matthias Kirschner
Reprinted with permission from Daniel Pocock
Helping FSFE scam victims and conference organisers
Reprinted with permission from Daniel Pocock
Nigerian fraud in FSFE constitution
Reprinted with permission from Daniel Pocock
Worrying and Amusing Stories of "Clown Computing" Gone Awry
Many of these disasters could be avoided
Links 22/10/2025: Amazon Plans to Replace Workers With Robotics, AWS and Clown Computing in General Ridiculed
Links for the day
Gemini Links 22/10/2025: Niri Completely Changes Multitasking and Overview of Diff-ers
Links for the day
Links 22/10/2025: Study on Misinformation by Slop and Heavily Debt-Sabbled Microsoft OpenAI (ClosedSlop) Uses "Browser" as Gimmick/Distraction
Links for the day
They've Already Spent Close to a Million Dollars on Lawyers and Sent Us About 50 KG of Legal Papers (Sponsored by Mysterious Third Party) to Try to Censor Techrights, Without Success
They try to overcompensate with sheer volume for a lack of solid, clear arguments (we are the victims here)
12 Months Ago the 'Hulk Hogan of UEFI' Officially Went 'Tag-Team'
We're actually sort of flattered or proud that such despicable people are so desperate to censor us
"Cloud Computing" Was Always a Joke, But This Week Was the Punchline
Maybe stop following tech trends and fashions
"Cloud Computing" Does Not Mean Safety
Fault tolerance is related to the notion of software freedom
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Tuesday, October 21, 2025
IRC logs for Tuesday, October 21, 2025
The Fall of Windows: From Something to Nothing
Of course Microsoft will pretend everything is fine and "just trust the hey hi" (AI)