[00:00.000 --> 00:11.080] I just have to mention that our board has put out a recruitment call, a call for nominations. [00:11.080 --> 00:15.360] We're trying to expand our board, so if you go to FSF.org, it'll be the top news item. [00:15.360 --> 00:20.560] It's something I just want to plug before I get started. [00:20.560 --> 00:22.760] We also hosted another conference in a month. [00:22.760 --> 00:25.800] You'll see some information about that too. [00:26.560 --> 00:40.400] My talk is about SAS, and that stands for Public Speaking. [00:40.400 --> 00:43.720] It takes just a minute. [00:43.720 --> 00:50.040] A service as a software substitute. [00:50.040 --> 00:58.600] What that means is when you use a service and you use it to substitute for your own computing. [00:58.600 --> 01:03.800] That's a little abstract, so it's best if I give an example. [01:03.800 --> 01:07.760] The one I like to give is a photo editing service. [01:07.760 --> 01:13.200] Say you go to a website, you upload a photo, you tell it you want to turn it black and white, [01:13.200 --> 01:19.560] and you click a button, it does it, and then you click download and you've got the photo. [01:19.560 --> 01:30.560] Well, that computation done on the server is something that you should control with a free photo editing program, like GIMP. [01:30.560 --> 01:41.080] When you use a service like that, you give away your software freedom in a very similar way to using a proprietary program on your computer. [01:42.080 --> 01:50.080] But in some ways it's even worse, because the server operator, it's automatically spyware, has all your data, [01:50.080 --> 01:55.080] and it automatically has a backdoor to make changes at any time. [01:55.080 --> 02:00.080] So in some ways even worse than a proprietary software. [02:00.080 --> 02:12.080] So I want to talk about, that's sort of the basic case, but I'm going to assume you understand software freedom a bit, [02:12.080 --> 02:17.080] so I'm going to go into some more other cases. [02:17.080 --> 02:23.080] So let's talk about first some basic examples of when something is not SAS. [02:23.080 --> 02:33.080] So when somebody else is inherently involved in the activity, that's kind of usually a good giveaway. [02:33.080 --> 02:36.080] So communication service is an example. [02:36.080 --> 02:39.080] Say I want to send you a message across the internet. [02:39.080 --> 02:42.080] We need some intermediary to write that message. [02:42.080 --> 02:48.080] I don't have a direct connection to everybody else, so somebody has to provide a service to do that. [02:48.080 --> 02:51.080] It's necessary. [02:51.080 --> 02:55.080] Another good example is publication. [02:55.080 --> 03:00.080] So I give you some data, I send you an email, I say you can publish it. [03:00.080 --> 03:06.080] Well there's nothing wrong with you doing that, versus me doing that, it's just publishing information. [03:06.080 --> 03:17.080] Now some websites offer multiple services, and well, or one, they call it one service, but it has many different use cases. [03:17.080 --> 03:20.080] Some are SAS, and some aren't. [03:20.080 --> 03:25.080] So let me digress just for a second. [03:25.080 --> 03:28.080] This SAS has nothing to do with the SAS with two Ss. [03:28.080 --> 03:34.080] It was kind of meant to be a bad pun, and it didn't work out that great, [03:34.080 --> 03:40.080] but just know that when I'm saying SAS, I'm talking about the SAS with the three Ss, [03:40.080 --> 03:43.080] and you just have to understand by context. [03:43.080 --> 03:48.080] So as I was saying, some services have multiple use cases. [03:48.080 --> 03:50.080] Some are SAS, some aren't. [03:50.080 --> 03:53.080] An example would be the website Flickr. [03:53.080 --> 04:02.080] It's meant to share photos, publication, not SAS, but then it also has photo editing features that is SAS, as I talked about. [04:02.080 --> 04:07.080] So let's move on to another example, a backup service. [04:07.080 --> 04:15.080] So a backup service is something people often like to run themselves. [04:15.080 --> 04:17.080] So you think, well, is it SAS? [04:17.080 --> 04:18.080] Is it not? [04:18.080 --> 04:25.080] Well, if the point of the backup service is to give you back your files exactly as you gave it to them, [04:25.080 --> 04:31.080] then it's not SAS, because there's no computation there that you should control [04:31.080 --> 04:35.080] if you're only hoping to get back the exact same data that you gave it. [04:35.080 --> 04:37.080] The result wouldn't be any different. [04:37.080 --> 04:41.080] Now, you may want to run that backup service for reasons other than SAS. [04:41.080 --> 04:43.080] Maybe you think it's more reliable. [04:43.080 --> 04:45.080] Maybe you think you have some privacy there. [04:45.080 --> 04:50.080] And that's one of the complications with SAS, and services in general, [04:50.080 --> 04:55.080] is that there are other concerns besides SAS that are often very important to people. [04:55.080 --> 04:59.080] So it makes it a little difficult to talk about. [04:59.080 --> 05:04.080] That's part of the reason I'm talking about it today. [05:04.080 --> 05:10.080] How about the case of a database as a database service? [05:10.080 --> 05:13.080] For example, a SQL database service. [05:13.080 --> 05:21.080] Well, in this case, SQL queries are actually complex computation. [05:21.080 --> 05:23.080] There's huge manuals for them. [05:23.080 --> 05:28.080] Exactly how they work matters to the people using it. [05:28.080 --> 05:30.080] They want specific database programs. [05:30.080 --> 05:32.080] They care about what the version is running. [05:32.080 --> 05:34.080] They care about how that computation is run. [05:34.080 --> 05:39.080] So yes, it would be a SAS if it's a database service. [05:39.080 --> 05:46.080] But then think about contrast, a backup service, and a database service. [05:46.080 --> 05:51.080] So say you use a database service, but you use it like a backup service. [05:51.080 --> 05:56.080] You just dump some data into a single table, and you just retrieve that table. [05:56.080 --> 06:01.080] Well, then you're using it like a backup service, and suddenly it's not SAS anymore. [06:01.080 --> 06:08.080] So what we have to think about is the primary purpose of how you're using the service. [06:08.080 --> 06:20.080] And when I say primary purpose, that brings me to a secondary purpose. [06:20.080 --> 06:24.080] Well, it's not really a secondary purpose that I want to talk about. [06:24.080 --> 06:29.080] But let me bring up another example. [06:29.080 --> 06:33.080] Say you upload some files to your backup service. [06:33.080 --> 06:38.080] And then you say to the backup service, what files do I have? [06:38.080 --> 06:43.080] And the backup service returns you a list of files sorted alphabetically. [06:43.080 --> 06:50.080] Well, if you had a list of files on your computer and you wanted it sorted, [06:50.080 --> 06:53.080] well, that would be something you would want to do on your computer. [06:53.080 --> 06:57.080] You'd want to run the sorting algorithm, something you should control. [06:57.080 --> 06:59.080] How it's sorted definitely matters to you. [06:59.080 --> 07:00.080] That's your computation. [07:00.080 --> 07:06.080] But then when the backup service does it, well, it has to tell you those files, [07:06.080 --> 07:09.080] and it has to sort them somehow. [07:09.080 --> 07:12.080] It has to give you to them in some sorted order. [07:12.080 --> 07:21.080] So in this case, it's doing computation that is what I call incidental computing. [07:21.080 --> 07:23.080] It's not your primary purpose. [07:23.080 --> 07:26.080] Your purpose is just to find out what files are on the backup service. [07:26.080 --> 07:31.080] Incidentally, there has to be some computing done in that process, [07:31.080 --> 07:36.080] which happens to also be like computing you would do on your own computer [07:36.080 --> 07:38.080] if you were running locally. [07:38.080 --> 07:42.080] But it's not the primary purpose of using that service. [07:42.080 --> 07:44.080] So it wouldn't be SAS. [07:44.080 --> 07:47.080] Another way to call it was ancillary computing. [07:47.080 --> 07:50.080] And so when you pick apart a service in its use cases, [07:50.080 --> 08:00.080] this is one way to narrow down the issue to whether something is SAS or it's not SAS. [08:00.080 --> 08:03.080] Now, for another more complicated example, [08:03.080 --> 08:07.080] I've been talking about the computing of an individual person, [08:07.080 --> 08:14.080] but groups can come together for a common purpose, form an organization or a project, [08:14.080 --> 08:18.080] and then they use a server to collaborate with each other. [08:18.080 --> 08:26.080] And an example of this would be Wikipedia, which runs, well, media Wiki, [08:26.080 --> 08:30.080] and Wikipedia and groups who run media Wiki. [08:30.080 --> 08:38.080] Now, that service has features like document editing, [08:38.080 --> 08:42.080] different diffing documents, conflict resolution. [08:42.080 --> 08:47.080] Those are the type of computing, if you were working on your own, [08:47.080 --> 08:50.080] something you would want to control on your computer, [08:50.080 --> 08:56.080] but because you're working collaboratively with a group, [08:56.080 --> 09:01.080] you could say the group's computing, [09:01.080 --> 09:10.080] and that group should be able to control its own computing by running its own server and the software on it. [09:11.080 --> 09:14.080] You could say when you join in with that group, [09:14.080 --> 09:18.080] you're a member of that group and you're collaborating and doing that group's computing, [09:18.080 --> 09:21.080] so you can use those sort of features together. [09:21.080 --> 09:25.080] And this is a little bit hard to think about, [09:25.080 --> 09:31.080] because sometimes your computing versus a group's computing can get a little blurry sometimes, [09:31.080 --> 09:37.080] but it's important to realize and think about. [09:37.080 --> 09:44.080] So, onto another example, think about bug tracking, a bug tracker. [09:44.080 --> 09:52.080] This is a very common piece of software that developers use. [09:52.080 --> 10:02.080] Now, one way that a bug tracker could work or does work for some projects [10:02.080 --> 10:06.080] is they have a mailing list where they say, [10:06.080 --> 10:11.080] bugs go to this mailing list, so somebody sends an email to the mailing list, [10:11.080 --> 10:15.080] say, I have a bug, and somebody responds and says, yes, I agree, that's a bug, [10:15.080 --> 10:18.080] or somebody says, no, I don't think so, and they discuss it. [10:18.080 --> 10:24.080] Well, this is just a form of communication and publication, [10:24.080 --> 10:29.080] like a normal mailing list, and I wouldn't call that sass. [10:29.080 --> 10:37.080] But consider a software like Bugzilla, [10:37.080 --> 10:43.080] or it doesn't work that way, especially with a larger project, [10:43.080 --> 10:49.080] you customize it so that it has maybe even hundreds of fields, [10:49.080 --> 10:58.080] and the people who are administering it are doing complicated queries, [10:58.080 --> 11:05.080] on all of the bugs, running queries that will modify all the bugs, [11:05.080 --> 11:09.080] reassign them, and then it's starting to look like a database with a front-end, [11:09.080 --> 11:14.080] a complicated database with a front-end, and then I would call that sass. [11:14.080 --> 11:23.080] And this, I think, brings up a little bit of a problem in that it's very difficult to, [11:24.080 --> 11:27.080] you know, a lot of projects want software projects, [11:27.080 --> 11:33.080] want sophisticated software for their project, [11:33.080 --> 11:37.080] but they don't necessarily have the means to run that software, [11:37.080 --> 11:44.080] and like a Bugzilla, because complicated software is complicated to run, [11:44.080 --> 11:48.080] especially as a service, because you have data, you have backups, [11:48.080 --> 11:52.080] you have all of the details of running complicated software. [11:52.080 --> 12:00.080] So in that case, it's like, are a lot of projects out there actually running sass, [12:00.080 --> 12:01.080] giving up their freedom? [12:01.080 --> 12:10.080] Well, yes, basically, but it's an area where we have a long way to go, I think. [12:10.080 --> 12:16.080] And a good way to deal with that situation is for projects to come together [12:16.080 --> 12:23.080] in sort of a larger project that is in their collective interests. [12:23.080 --> 12:31.080] So some of the software I run, or I help run, like the GNU project, [12:31.080 --> 12:34.080] where many software packages come together, [12:34.080 --> 12:37.080] share the infrastructure that's going to be in all of their interests, [12:37.080 --> 12:45.080] and that way they're sort of doing a group computation together for like a bug tracker. [12:45.080 --> 12:52.080] But now this brings me to an example of GitHub. [12:52.080 --> 12:59.080] So when I think of GitHub, I look around at the GitHub service, [12:59.080 --> 13:03.080] and I think there are a few features that are clearly sass. [13:03.080 --> 13:06.080] One, some obvious examples would be continuous integration. [13:06.080 --> 13:09.080] That's like they kind of give you a virtual machine and say, [13:09.080 --> 13:11.080] run some code on your software. [13:11.080 --> 13:18.080] And well, if the code that you're running, well, is their code, [13:18.080 --> 13:22.080] then I guess that brings up another topic of virtual machines, [13:22.080 --> 13:26.080] which are not sass if you control them. [13:26.080 --> 13:30.080] And another feature of GitHub would be like, [13:30.080 --> 13:36.080] they have a feature to tell you which functions in two repositories are different. [13:36.080 --> 13:43.080] Well, clearly that would be sass because it's parsing the language of the repositories. [13:43.080 --> 13:47.080] It's doing a complicated function level diff on them. [13:47.080 --> 13:52.080] And then some other features I think would not be sass, [13:52.080 --> 13:56.080] like simply publishing a Git repository. [13:56.080 --> 14:02.080] That's just a publication of information, not sass. [14:02.080 --> 14:05.080] And then their bug tracker, for example. [14:05.080 --> 14:11.080] I think in its basic form, it works very much like a simple form, [14:11.080 --> 14:15.080] like a mailing list that one person posts and another person replies. [14:15.080 --> 14:18.080] And I would call that just a communication service. [14:18.080 --> 14:23.080] But I'm not too familiar with all of the advanced features of GitHub, [14:23.080 --> 14:26.080] but I get the suspicion that some of the, maybe, [14:26.080 --> 14:31.080] there might be some features of the bug tracker which go into the sass area [14:31.080 --> 14:36.080] when it gets more complicated, when you're an advanced user of all of the features there. [14:36.080 --> 14:39.080] So I haven't picked apart every piece of GitHub, [14:39.080 --> 14:43.080] and it takes some time to do that analysis, which I haven't done. [14:43.080 --> 14:48.080] But in general, this brings me to the next topic, [14:48.080 --> 14:53.080] is that, well, I don't know how many minutes do I have left? [14:53.080 --> 14:54.080] Ten minutes. [14:54.080 --> 14:56.080] Ten minutes? Great. [14:56.080 --> 15:03.080] Okay, so I think I'm done with some basic examples of analyzing sass or not, [15:03.080 --> 15:10.080] and I'm happy to talk to people because there sometimes aren't bright lines. [15:10.080 --> 15:20.080] And it's a little blurrier than with determining if a piece of software is free or not, [15:20.080 --> 15:24.080] but it's not like there isn't blurry lines in that either. [15:24.080 --> 15:27.080] So I think it's just something we have to deal with. [15:27.080 --> 15:30.080] It's part of a lot of ethical issues, have their gray areas, [15:30.080 --> 15:33.080] and I just happen to be highlighting them. [15:33.080 --> 15:34.080] That's all. [15:34.080 --> 15:40.080] I don't think it's an inherent problem with sass at all, with the concept of sass. [15:40.080 --> 15:45.080] So now I want to bring up one common misconception, [15:45.080 --> 15:50.080] is that a service which publishes some free source code that it says it's running [15:50.080 --> 15:54.080] means that the users of the service have software freedom. [15:54.080 --> 15:56.080] They don't. [15:56.080 --> 15:58.080] The users don't control that service. [15:58.080 --> 16:01.080] They can't tell it what program to run. [16:01.080 --> 16:07.080] You can only do that with a program on a server you control or on your own computer. [16:07.080 --> 16:12.080] And there may be important code that it runs besides what's published. [16:12.080 --> 16:19.080] I mean, generally, servers are not publishing the operating system or other things. [16:20.080 --> 16:23.080] The first reason I gave is basically the fundamental one, [16:23.080 --> 16:26.080] but some other ones are that. [16:26.080 --> 16:31.080] And of course, you can't ever be sure what somebody else's server is doing. [16:31.080 --> 16:33.080] You haven't installed the program. [16:33.080 --> 16:35.080] You can't be 100% sure. [16:35.080 --> 16:43.080] It's different than running your own code on a server you control. [16:43.080 --> 16:45.080] So for services that are not sass, [16:45.080 --> 16:48.080] I'm going to talk about this idea of publishing source code [16:48.080 --> 16:52.080] and think about the difference and the interaction between sass [16:52.080 --> 16:55.080] and the publishing of service source code. [16:55.080 --> 17:02.080] So when we think about publishing service source code, [17:02.080 --> 17:06.080] I think about the AGPL, which says you have to publish the source code [17:06.080 --> 17:10.080] if it's a service to the users of it. [17:10.080 --> 17:17.080] And what we say is that the publishing of source code benefits the community [17:17.080 --> 17:22.080] so that they could use that source code. [17:22.080 --> 17:31.080] And that benefit is so important to people being able to use that code [17:31.080 --> 17:35.080] that it's worth mandating with AGPL. [17:35.080 --> 17:45.080] And we recommend it for all software that is intended to be run as a service. [17:45.080 --> 17:52.080] And in fact, now, not thinking about the sass issue, [17:52.080 --> 17:58.080] but just in general, if I encounter a service and I say, [17:58.080 --> 18:03.080] I think, would there be any reason somebody else besides the server operator [18:03.080 --> 18:06.080] would want to run it? [18:06.080 --> 18:11.080] If there is, if there's a plausible case of that, [18:11.080 --> 18:17.080] I think, well, then are they publishing the source code? [18:17.080 --> 18:19.080] If they aren't, why not? [18:19.080 --> 18:23.080] I mean, why do they not want to benefit the community? [18:23.080 --> 18:29.080] And another benefit that brings, [18:29.080 --> 18:35.080] I think the biggest one is if the service is working well, good. [18:35.080 --> 18:41.080] Maybe there's some fundamental services we all rely on, like DNS services. [18:41.080 --> 18:47.080] But then if the service stops working, [18:47.080 --> 18:52.080] it adds conditions that people don't want to agree to. [18:52.080 --> 18:55.080] It adds, it changes. [18:55.080 --> 18:59.080] Well, then the publishing of source code is sort of an insurance policy [18:59.080 --> 19:03.080] that somebody else could start up a new service and users could move over there. [19:03.080 --> 19:08.080] And that is so important that I think it's worth considering that in general [19:08.080 --> 19:12.080] whenever for any service, which is separate than the sass issue. [19:12.080 --> 19:19.080] So, and I think if we take a service like GitHub, I think that's obvious. [19:19.080 --> 19:22.080] Of course, people would want to run their own GitHub, [19:22.080 --> 19:29.080] but so why we shouldn't accept a GitHub that doesn't have the service source code published. [19:29.080 --> 19:36.080] It's just foolish to subject yourself to the whims of that service operator [19:36.080 --> 19:41.080] without having some sort of insurance to go somewhere else, [19:41.080 --> 19:46.080] even if you aren't using it as a sass way. [19:46.080 --> 19:55.080] So, I'm going to move on to my next topic, which basically I think the sass [19:55.080 --> 20:01.080] has not gotten enough attention in free software advocacy. [20:01.080 --> 20:04.080] And why hasn't? I think there's lots of reasons. [20:04.080 --> 20:07.080] I talked a little bit about the complexity. [20:07.080 --> 20:12.080] I think sass was far less common in the past. [20:12.080 --> 20:18.080] Nowadays, most services tend to require non-free software as a client, [20:18.080 --> 20:20.080] usually in the form of JavaScript. [20:20.080 --> 20:28.080] And that's, so services in general have caused a lot of problems for software freedom, [20:28.080 --> 20:30.080] other problems besides sass. [20:30.080 --> 20:37.080] So, but like I said, I think sass needs to get more attention because it's becoming more prevalent. [20:37.080 --> 20:41.080] Database services have, in the past few years, become very popular. [20:41.080 --> 20:45.080] Before that, it was much more common to run your own database. [20:45.080 --> 20:49.080] A lot of people are relying on these services, which are sass. [20:49.080 --> 20:57.080] And so, oh, I think one interesting historical reason for lack of focus on sass [20:57.080 --> 21:01.080] is that, well, it's not part of the GPL. [21:01.080 --> 21:04.080] It's not part of any license. [21:04.080 --> 21:09.080] When the GPL was being drafted, the FSF had its lawyers [21:09.080 --> 21:14.080] try and think of a way to add in a provision against sass, [21:14.080 --> 21:16.080] and they couldn't think of a way to do it. [21:16.080 --> 21:19.080] Now, so they just didn't. [21:19.080 --> 21:22.080] And so when we say the GPL protects your freedom, [21:22.080 --> 21:25.080] well, there's one little hidden asterisk there, [21:25.080 --> 21:28.080] as long as you don't give it away in a sass. [21:28.080 --> 21:33.080] And I'd be curious to know some of the lawyers, [21:33.080 --> 21:36.080] maybe some lawyers here today, if they still think that's the case. [21:36.080 --> 21:39.080] If there's no way to have a sass provision in a license, [21:39.080 --> 21:41.080] I'd be curious to what that is. [21:41.080 --> 21:44.080] I mean, it's the one case, I think, of the FSF saying, [21:44.080 --> 21:46.080] here's an important issue. [21:46.080 --> 21:48.080] We couldn't write into the license. [21:48.080 --> 21:53.080] I haven't heard many people talk about how that could be done. [21:53.080 --> 21:56.080] Maybe not covering all sass, but some portion of it. [21:56.080 --> 21:57.080] I don't know. [21:57.080 --> 22:04.080] I'm not a lawyer, but I would love to hear from some. [22:04.080 --> 22:07.080] So how can we give sass more attention? [22:07.080 --> 22:08.080] I don't have all the answers. [22:08.080 --> 22:09.080] It's just a couple ideas. [22:09.080 --> 22:12.080] I think number one is just to simply call it out more. [22:12.080 --> 22:15.080] When a company has a sass business model to say, [22:15.080 --> 22:17.080] hey, their business model is sass. [22:17.080 --> 22:19.080] That's taking away people's freedom. [22:19.080 --> 22:22.080] That's a very simple way. [22:22.080 --> 22:30.080] Another idea I have is that there's this term self-hosting, [22:30.080 --> 22:35.080] which basically seems to cover the idea of sass plus other things. [22:35.080 --> 22:39.080] It's the idea of services, run yourself. [22:39.080 --> 22:43.080] And sometimes it's even expanded to just non-services, [22:43.080 --> 22:46.080] a sass services that should be run on your own computer [22:46.080 --> 22:48.080] and not as a service at all and running themselves, [22:48.080 --> 22:50.080] and people call that self-hosting. [22:50.080 --> 22:54.080] So the idea of self-hosting kind of covers sass plus other things. [22:54.080 --> 22:57.080] So I think also advocating for self-hosting [22:57.080 --> 23:04.080] and saying self-hosting overlaps very well with software freedom [23:04.080 --> 23:08.080] is a way that we can advocate against sass [23:08.080 --> 23:13.080] without having to deal with the complexity of sass itself, [23:13.080 --> 23:17.080] of explaining it fully. [23:17.080 --> 23:23.080] And I'm getting to the end of my talk here. [23:23.080 --> 23:25.080] I think most of the ideas I want to share, [23:25.080 --> 23:27.080] I'd be happy to talk to people afterwards. [23:27.080 --> 23:30.080] And one shout-out to a specific program, GNU Units, [23:30.080 --> 23:34.080] which is a small sass that many people use. [23:34.080 --> 23:39.080] They ask Google or Search Engine to convert between Celsius or Fahrenheit. [23:39.080 --> 23:41.080] And there's a program you can do that on your own computer [23:41.080 --> 23:44.080] called GNU Units, so look it up. [23:44.080 --> 23:46.080] And that's all I've got. [23:46.080 --> 23:48.080] Thank you very much.