Please consider adding <[email protected]> to your address book, which will
ensure that our messages reach you and not your spam box!*

Read and share online:
<[link removed]>


Dear Free Software Supporter,

*Ian Kelling, Free Software Foundation (FSF) senior systems
administrator and our president, outlines the complex steps the FSF
tech team goes through to ensure the software we use is free. The tech
team — currently just two people — is vital to our collective work for
software freedom, which itself helps guarantee many of our other basic
freedoms. We depend on people just like you to support our work: we
have an associate membership drive to welcome 100 new members by
January 16.* *Please [join the FSF][0] and help keep this work going.*

[0]: [link removed]

My name is Ian Kelling. I am the senior systems administrator at the
FSF and also the president of the FSF, a role I fulfill on a voluntary
basis. The FSF tech team runs a lot of software, including
[sixty-three][1] different services, platforms, and websites for the
FSF staff, the GNU Project, other community projects, and the wider
free software community. We work hard to do it all on our own
computers, so we maintain a dozen physical servers in two Boston data
centers.

[1]: [link removed]

The tech team isn't one of the more publicly visible teams at the FSF.
Behind the scenes, we put in a lot of effort to be able to do our work
in software freedom and help others do the same. This isn't just
something we have to do in minor edge cases; we can only host
conferences, schedule meetings, and process financial transactions as
a result of this work. We're glad to say it helps thousands. The work
we put in to making sure a program is free for us also makes it free
for the rest of the world.

We are always on the lookout for new software. There are hundreds of
thousands of useful free software programs in the world; figuring out
which ones to use and whether a program is free software is a
challenge we tackle regularly. The first place we often look for a
free program is in the package repository of a [free as in freedom
GNU/Linux distribution][2], such as [Trisquel][3] in our case. To
search the repository, I usually start with the standard command-line
approach of `apt-cache search`. This searches through tens of
thousands of packages. One of the biggest reasons we start with this
method is that we know that this software has gone through a thorough
review to determine it is free by the developers of the operating
system. There is another notable collection of verified free software
that can search through because of a program we run ourselves: the
[Free Software Directory][4]. When searching both places doesn't
yield a good result, we look further afield to a search engine or
Wikipedia.

[2]: [link removed]
[3]: [link removed]
[4]: [link removed]

### Working with others to avoid nonfree software
During the COVID-19 pandemic, like everyone everywhere, the FSF
increased its videoconferencing use, especially videoconferencing
software that works in web browsers. We have experience hosting
several different programs to accomplish this, and [BigBlueButton][5]
was an important one for us for a while. It is a videoconferencing
service which describes itself as a virtual classroom because of its
many features designed for educational environments, such as a shared
whiteboard.

[5]: [link removed]

When we find a program outside of a trusted source that looks
promising, one of the first things we do is to review the license(s)
of the software, and check that it comes with source code, not just
opaque binaries or minified JavaScript. It is usually pretty easy to
find some indication of the license or licenses the program is under,
but based on experience, we don't trust the first indication we find.
The FSF has documented a basic process of verifying that software is
[free][6], and on the tech team, we have a lot of experience in
digging deeper. I'd love to document more of that, but keep in mind
that the FSF tech team is just two people trying to accomplish as much
as we can for the free software movement. We rely on contributions
from people like you.

[6]: [link removed]

I recently re-reviewed the licensing for BigBlueButton and it took me
about four hours. *(For reference: I checked a recent development
version, git commit `b14adecd`).* BigBlueButton includes hundreds of
NodeJS JavaScript dependencies, which calls for some additional
automation. I use the [ScanCode][7] like [ScanCode Toolkit][8], and I
also check the npm license metadata using `npx license-checker`.

[7]: [link removed]
[8]: [link removed]

Why did I re-review BigBlueButton? In BigBlueButton 2.2, the program
used a freely licensed version of MongoDB, but it unintentionally
picked up MongoDB's 2018 nonfree license change in versions 2.3 and
2.4. At the FSF, we noticed this and raised the alarm with the
BigBlueButton team in late 2020. In many cases of a developer changing
to a nonfree license, free forks have won out, but in this case no one
judged it worth the effort to maintain a fork of the final free
MongoDB version. This was a very unfortunate case for existing users
of MongoDB, including the FSF, who were then faced with a challenge of
maintaining their freedom by either running old and unmaintained
software or switching over to a different free program.

Luckily, the free software world is not especially lacking in high
quality database software, and there is also a wide array of free
videoconferencing software. At the FSF, we decided to spend some
effort to make sure MongoDB would no longer make BigBlueButton
nonfree, to help other users of MongoDB and BigBlueButton. We think
BigBlueButton is really useful for [free software in schools][9],
where it is incredibly important to have free software.

On the tech team, especially when it comes to software running in a
web browser, we are used to making modifications to better suit our
needs. In the end, we didn't find a perfect solution, but we did find
[FerretDB][10] to be a promising MongoDB alternative and assisted the
developers of FerretDB to see what would be required for it to work in
BigBlueButton. The BigBlueButton developers decided that some
architectural level changes for their 3.0 release would be the path
for them to remove MongoDB. As of [BigBlueButton 3.0][11], released in
2025, BigBlueButton is back to being entirely free software!

[9]: [link removed]
[10]: [link removed]
[11]: [link removed]

### The importance of licensing
As the amount of free software programs is vast, there are also a
great deal of free and nonfree software licenses. We have a licensing
team which [reviews licenses and publishes their findings][14], and as
that page states, "If you are contemplating writing a new license,
please also contact us at <[email protected]>. The proliferation of
different free software licenses is a significant problem in the free
software community today, both for users and developers." There is no
way for the FSF to publish an evaluation of every free license, much
less every nonfree license we encounter in the wild, so we have to use
our best judgment. If the FSF hasn't published an evaluation of a
license, a good question to ask is whether it is used by any package
distributed in a libre GNU/Linux distribution.

[14]: [link removed]

Sometimes if you search online for what other people say about a
license, the results can be misleading. MongoDB joined a very
long-running trend of companies dubiously claiming an association with
the FSF's work or the free software movement for their benefit. We run
into various license terms which look a bit similar to [copyleft][15]
and get called copyleft, but they are not copyleft. For example, as you
can find on the FSF's license review list, the [Reciprocal Public
License][14] is nonfree for reasons which include its: "requiring
publication of any modified version that an organization uses, even
privately." People have mistaken that requirement to mean that the
license is copyleft. It isn't; it is a nonfree restriction. If you see
a license that claims to be copyleft, I suggest checking
<[link removed]>, and to otherwise
be skeptical. If a license says it is based on the GPL, consider that
it might be better described as a gross perversion of the GPL rather
than based on it.

[15]: [link removed]

Can you support our work to host services for the free software
movement and help make computing free (as in freedom) for all? We
can't do any of this without your help. If you can, will you [become
an associate member][0]? We need just 50 more members to reach our
associate membership goal of 100 new associate members by January 16.
Doing so will also get you access to our many [membership
benefits][16], and is just $12 USD per month ($6 for students).

[0]: [link removed]
[16]: [link removed]

As you can see, in the world of free software, trust can be tricky,
and this is part of why organizations like the FSF are so important.
In a world so big, we need the FSF to have the resources, including
the financial, to put the values of free software into practice and
help other people do it in order to spread the free software movement
across the globe. And, with a team of just 11 people, your support
makes a real difference to us.

Yours in freedom,

Ian Kelling
President and senior systems administrator
--
Interested in helping us expand our reach?

* Follow us on Mastodon at <[link removed]> and PeerTube at <[link removed]>, showing your support for federated social networks.
* Get active on the LibrePlanet wiki: <[link removed]>.
* Share on your blog or [social network]([link removed]) that you support us, and why you do so.
* Subscribe to our RSS feeds: <[link removed]>.
* Join us as an associate member: <[link removed]>; and display your membership button (<[link removed]>) on your website.

Read our Privacy Policy: <[link removed]>.

Sent from the Free Software Foundation,

31 Milk Street
# 960789
Boston, Massachusetts 02196
United States


You can unsubscribe from this mailing list by visiting

[link removed].
To stop all email from the Free Software Foundation, including Defective by Design,
and the Free Software Supporter newsletter, visit

[link removed].