Hello again, siva.

Concerning the installation of proprietary components,

When I say that it should be made sure that "the user really wants to and knows what s/he's doing", what I mean by this is that,

(I have been introduced to Debian a long time ago - and so, I don't know now to what extend did Debian use to do something in this regard, on its wiki pages - or if it was Ubuntu that, in its first releases and documentation, made this clear about repositories... But, even if they didn't originally,)

The correct way to deal with this issue, in my opinion, (besides having the proprietary components not included in the installation media, for more security) is to have, on the instructions of how to add proprietary components, in the part that describes how to activate the necessary repositories, a preceding warning/indication, where it's (explicitly) stated something like:

So that, when using the installer, instead of a novice to GNU/Linux just (unreflectively) choosing "Yes" (to quickly move on with the installation) to a mere question about if s/he wants to add a proprietary component, s/he is instead forced to read such a warning in the instructions of how to do this, and be educated (i.e. warned) about the important issue in question.

And, as a side note,

Having a distribution that behaves like Debian does right now, is also a way to please both the "purists", who only want to use Free Software, and the people who care less about this issue. Since that, unless a user modifies him/herself the "sources.list" file, Debian is practically just like any other fully "libre" distribution. And, those who want to use proprietary components and software can also use them in the same distribution. (With this also practically eliminating the need for people to create, and maintain, a separate fully "libre" variant of the same distribution.)

Concerning what I can do, to help (in practical terms) with such an installer, or with a possible mirror,

Unfortunately, I don't know how to properly program (besides basic stuff), and also don't have the time to involve myself in the creation and maintenance of a mirror (too much important stuff to deal with already, in my volunteer "citizen journalism" activity, on my free time). So, I'll have to stick to making small donations, so that other people who know how to do this kind of stuff can do it instead.

But, my "contribution" to this particular subject of the installer can then be the simple suggestion that, the best thing to do, in my opinion, (besides getting rid of systemd and its dependencies, and adjusting other packages to the absence of such) is to just modify Debian's original installer in the parts where it refers to "Debian", instead of "Devuan", and in those where there are links to the original mirrors - and, just leave all the rest as it is.

Debian is already a great distribution in itself. So, there's no need to modify anything about it, in my opinion (besides removing the systemd component). Also, from the name "Devuan" that's what I think that everyone is also expecting (i.e. for this distribution to be just a "Debian without systemd").

I'm not trying to pull anyone towards anywhere.

I just have the habit of, whenever I claim something that goes against what people believe to be true, present the proofs or basis of my claims, so that anyone can know where I come from (i.e. that I'm not just making things up) and make their own judgement about what I say. And, when responding what I did to you, I again felt the need to present arguments for my claims. That's it.

Besides, I think I've already presented every concern that I have with any aspect of this particular distribution (Devuan). So, I don't expect to post anything in here more that might be upsetting to somebody.

[EDIT: I will then just put a "strike through" on top of the last two paragraphs in that last post of mine, since they're unnecessary, in this case, to argument my personal scepticism about the "Tor" network. P.S. - Thank you, anyway, for your tip - and, also for all your help.]

Hello again, fsmithred.

Indeed, Gnuinos is (for the reasons you've stated) the most interesting Devuan-based distro I've come across (and, one in which all my security concerns with proprietary software are eliminated). But, unfortunately, they don't have a stable release yet...

But, yes. Either Gnuinos or an undoubtedly safe installation of Devuan should be my choice.

I will look also into those other two derived distros, the first one of which I didn't know about. Thank you very much for your tip.

siva,

Hi there.

(I see that such thread in the Debian forums really didn't pass unnoticed to you.) eheh

I understand that the BSD-family of distros might be even more secure than the GNU/Linux one. But, nevertheless, I would still like to stick with GNU/Linux - so that I can, once in a while, also play a (completely free) game or two, to unwind from intellectual work (like this one: https://www.etlegacy.com/).

msi,

I'm not spreading FUD about Devuan (or, at least, that's not my intention). I'm just exposing a very serious concern that I have, with a very specific aspect of one of its components. And, the reason why I do this, is because I would really like to adopt this distribution.

(Eitherwise, I wouldn't even bother participating in this forum, and would just leave for another distribution - which I don't want to, because this distribution is almost a *perfect* one for me, with the exception of what I call people's attention to.)

And, I'm not the kind of person who speaks or writes with so-called second intentions (as people say, in my native language) - and, therefore, I don't come here to make "suggestive statements".

As for "allegations", when I say that the installer is buggy and installs proprietary firmware, that's not me claiming that. I'm repeating what was said to me in another thread in here, by someone who (from what I understood) is involved in the creation of such installer. That is, I'm stating facts - not making allegations.

As for me being suspicious about proprietary software, I believe I've made very good points about, and given very good facts as base for, such concern of mine on other threads - so, I completely disagree that such concern is for "no good reason"...

Also, if I repeat the same arguments or facts in different threads, that's because I have to, in order to explain the different kind of questions I raise on those different threads. I cannot assume (or, above all, expect) that other people have read all my posts in other threads or subforums. And, I believe that the proper way to pose my questions, or raise my concerns, is to write them under the assumption that each one will be the only one that a person will read from me.

And, I really am sorry, if I end up being annoying because of all this...

But, my situation is that, the main reason why I adopted GNU/Linux as my main OS, was because I wanted to have a secure OS. And, therefore, I really don't like anything that might pose a risk (as I see it) to that same security.

And, I have very good reasons to worry about my computer security. Since, (besides having myself witnessed very strange things happening in non-secure computers that I had) what happens to other people who have the same (or similar) kind of political activity that I have, and who don't take the same kind of precautions I take, are things like this: https://www.youtube.com/watch?v=5utlGvodeAM#t=9m21s

[EDITED: Or, wait, I think I know of what you are specifically (also) talking about - and, I will therefore add another explanation shortly...]

I suppose you were referring to what was said in the first thread I created in here, and also to something I've said in a subsequent thread I created. And, also to clarify things on my side,

The bug you pointed me to didn't concern (at least, specifically) the situation I was describing. Since that, such bug is related to an "expert install" where one is given the option of "selecting" repositories. And, what happens to me, is when I do a regular (net) installation, where I'm not even asked about what repositories do I want to use or activate.

And, the fact that such bug doesn't correspond to my (specific) situation - together with what I said on my first thread, as to not believing or understanding how could what was happening to me be a sort of "bug", if Debian's original installer didn't have it - was the reason why, in a subsequent thread I created, I described the situation as "supposedly or reportedly because of some 'bug'".

I was not "suggesting" anything - but instead (clearly) implying something - with that. I was just (honestly, as is my costum) describing the situation as I see it (i.e. that this problem might have been wrongly identified as a bug or not). With the situation being that, I still cannot understand how this problem can be the result of some "bug", properly said - or, at least, as I understand one to be (i.e. an unintended flaw created by the necessary modification of a component, instead of something that was just deliberately and consciously added). But, I've quit trying to understand this, and just moved on...

I was calling everyone's attention to an aspect that didn't seem to be being noticed by some (in a way, kind of correcting people, if they were implying that the alternative didn't allow for such a thing also).

And yes, I was aware that I was also repeating some arguments already presented in this thread. But, this time, it was to present them as justification for a new aspect (education) that I hadn't mentioned before.

Even if the installer would always ask, when wanting to install any piece of proprietary software, if the user wanted to do so... If the user happens to make a wrong click or key press, s/he can accidentally install non-free software against her/his will.

We already have all sorts of distros that install proprietary firmware/software without even asking the user. And, the reason why I really like Debian, is because it doesn't do anything of this sort.

(If "user-friendliness" and nonconcern for the inclusion of proprietary firmware or software are the guiding lines, then people can fork Ubuntu, for example, instead.)

Debian clearly differentiates itself from other distros for only including, in its installer - and also using, under normal conditions - Free Software. And, if the user really wants to and knows what s/he's doing, s/he can nevertheless install proprietary software her/himself.

The use of anything proprietary should always be avoided and discouraged. Since that, proprietary software is, by its own nature, always potentially dangerous (ex: https://linux.slashdot.org/story/07/08/ … ox-profile).

Whenever possible, the best solution is to always substitute your components by ones for which there are free drivers and firmware (https://h-node.org/). And, when talking about laptops and other equipments that are more difficult to modify the components of, everyone can avoid all of these problems by informing her/himself first about the equipments they want before buying them.

Hello, golinux.

The commands that fsmithred and GNUser told me about, are very good tools, indeed. But, unfortunately, they don't really solve my problem. (With this being the reason why I proceed to ask so many questions.)

I really am sorry if I'm being a PITA... But, the problem I see with this default inclusion of non-free software, is that it can violate people's security and also ethical principles or concerns - with that only being "solved" after those two things have already occurred.

And, to be more explicit, I can give you an example.

I have an old laptop that can use, on its Wi-Fi card for its "free" driver, either (1) an incomplete (but functional, and completely) free firmware, or (2) a complete proprietary firmware.

And, on a FSF-approved distro that I tried, that (incomplete, but functional) free firmware is the one that is installed, and I can use my laptop with no problems.

Let's say that the alternative proprietary Wi-Fi firmware (of which we don't know the source code) might be able to steal my Wi-Fi password and send it somewhere else on the Internet. And, let's say that Devuan installs such proprietary firmware without telling me anything about it, I naively think that it must have installed the free one instead, and I only discover what really happened at the end of the installation, after having used my Wi-Fi password to proceed with such installation...

If that proprietary Wi-Fi firmware is really capable of stealing my password, then it will already be too late.

As I've just said in another thread, in here (https://dev1galaxy.org/viewtopic.php?pid=8377#p8377) the problem I have with all non-free software, is that I see it all as potentially dangerous (ex: https://linux.slashdot.org/story/07/08/ … ox-profile).

And, if the user decides to install a proprietary firmware (say, for wireless) during the installation,

With this bug fixed, will s/he be left with only the "main" repository activated, at the end of a fresh installation? (And, not the "contrib" or "non-free" repositories, from where that same firmware is originally from?)

If so, (that is, if the user ends up with proprietary firmware on his/her computer, but with only the "main" repository activated) this can:

1) be misleading - in the way that it might convince the user that only Free Software has been installed on his/her computer, when s/he checks the "sources.list"; and also

2) prevent those same pieces of non-free software from being updated.

It's a similar security risk as the one created by the "zeitgeist" daemon, whose development is sponsored by Canonical...

If you have a daemon that already keeps a log of all of the user's most important activity,

You don't even need to have a piece of malware installed on the computer, all the time, to know what the user is up to.

All that you need now, is to somehow read that same log, whenever you can - like, when a user decides to try out one of the many proprietary programs that Ubuntu encourages people to, on its "Software Centre" (and, more specifically, one that behaves like this: http://linux.slashdot.org/story/07/08/2 … ox-profile) - and there goes a whole log of the user's activity into the hands of Big Brother.