How does Parabola protects users against nonfree software

From ParabolaWiki
Jump to: navigation, search

Parabola follows the GNU Free System Distribution Guidelines. These criteria go beyond 100% free software: being 100% free software is often not enough to guarantee users freedom as users might still accidentally install nonfree software without realizing it.

For instance Parabola has modified versions of Firefox (like Parabola's Iceweasel or Icecat) which make the addons repositories have only free software. Without that, some users might think that all the addons are fully free software and install them without realizing that there could be nonfree. Parabola also removes free software whose only goal is to install nonfree drivers.

As the Free System Distribution Guidelines states: "Most distribution development teams don't have the resources to exhaustively check that their distribution meet all these criteria. [...] So we expect distros to occasionally contain mistakes: nonfree software that slipped through, etc. [...] Our requirement is for the distribution developers to have a firm commitment to promptly correct any mistakes that are reported to them.". So if you find issues, you can report them to the Parabola bug reporting system at https://labs.parabola.nu/ .


Additionally Parabola also doesn't cover everything. For instance:

  • The computers you run Parabola on can contain nonfree software. And Parabola might even run that software:
    • The BIOS or UEFI of your computer might be nonfree. Once the computer is booted they typically continue to run and Parabola will even run code from it (for instance code that is located in the ACPI tables).
    • Most AMD, ATI or Nvidia Graphic cards / GPUs contain nonfree software that is run both by the BIOS / UEFI and Parabola. That code is even run when using Libreboot.
    • All mass storage devices (Hard disks, SSD, microSD, USB keys, etc) contain a builtin nonfree firmware.
    • Other peripherals like displays, keyboards, printers, and so on, may also contain nonfree software, depending on the specific peripheral, but it's hard to know.

The FSF has a specification called Respects Your Freedom (RYF) for hardware to address that issue and list hardware that doesn't ship with nonfree software (with some exceptions, make sure to check the criteria).

Also some computers that are RYF certified like the Talos-II Mainboard don't support yet distributions that follows the Free System Distribution Guidelines (FSDG) guidelines, so make sure to also check about distributions support when getting hardware.

The Respects Your Freedom (RYF) certification is very strict:

  • It only covers hardware being sold (and it makes sure that people can buy the hardware without running nonfree JavaScript, and so on).
  • It also makes sure that everything works with free software

So it's also possible to have something equivalent without buying RYF certified hardware:

  • If you build yourself similar computers yourself with libreboot. However if you buy compatible hardware online you're on your own with things like nonfree JavaScript. Also sure to check The Libreboot documentation for information on compatibility.
  • Many ARM computers can boot with fully free software, and some are supported by Parabola. Here these computers are not certified by with the RYF certification yet because either not everything work with free software (for instance you might lack free software support for hardware video decoding) or because no company tried to apply for the certification. You can check the ARM_Installation_Guide for details on which ARM computers are supported by Parabola.

However a lot of computers (including ARM computers) don't even boot with free software so they are completely useless with freedom.

In addition there are also freedom issues on the Internet and on the web:

  • The web and the Internet also contain many software that don't follow the Free System Distribution Guidelines (FSDG) guidelines or are not free software at all: Many software project offer programs to download that are not free software. For instance Arch Linux on which Parabola is based has repositories with nonfree software. Some software like Firefox have addons repositories containing nonfree software. And there are even companies or individual distributing nonfree software. Finding out if every software available is free software or not, and if it respects the Free System Distribution Guidelines (FSDG) guidelines or not is out of the scope of Parabola, however Parabola still has some information on a subset of such software: it maintains a blacklist of known nonfree software in Arch Linux, and some of its packages are patched to not depend on nonfree software, or remove nonfree parts. In addition this wiki also sometimes has information about free software status for some software types, like emulators.
  • Many web pages include some JavaScript. With many browsers (like Firefox), that JavaScript is executed within the browser by default. While some of this JavaScript is free software, many isn't. And the fact that the code is in most browsers run automatically also raises some concerns because even if that code is free software, the way it's done forces users to run it, and doesn't leave users much practical freedoms (for instance the freedom to modify the JavaScript and run a modified version on the same page). The JavaScript Trap article has more details on this issue. In several browsers provided by Parabola (like Icecat), in the first start, users can choose if they wish to use the LibreJS addon to only run JavaScript labelled as free software, block all JavaScript, or run it all the JavaScript programs, including those which are not free software.
  • Many websites and services track users or make users dependent on the website in some way. Parabola has a package named your-privacy in the nonprism repository to remove support for some of these websites (like Facebook, etc) in some of the packages provided by Parabola.


In addition Parabola also has packages that use third party repositories. They have to be removed or patched if the repositories are known not to have a policy to only contain free software:

  • In some cases (like with debootstrap, or iceweasel) the programs are patched, in other cases like with guix-installer, the repository it refers to is already FSDG compliant.
  • But in other cases we are still are working to understand if certain programming languages repositories (like the ones available through pip for instance) have policies to only include free software. If they are found to not have a policy to include only free software we need to remove them.

Parabola also has additional policies that goes beyond the FSDG criteria:

  • Non functional data (like game data files) also need to be under free licenses.
  • As documented in the SYNTAX file in the blacklist repository, Parabola has a policy to only ship packages built from source. So if you find packages that are not built from source (for instance they download and ship a binary file, a java jar file, etc), then it is a bug and so you can bugreport if there isn't already a bug about the issue you found. This gives some more assurance that there is some corresponding source code. That source code can then be way more easily inspected to see if it is fully free.
  • ARM computers have to boot with fully free software to be officially supported by Parabola. This way a hardware vendor cannot trick users into thinking that because a given ARM computer is officially supported by Parabola it has to work with only free software (while in reality some computers that cannot boot with free software could be supported).