[security-discuss] CloudFlare, not good choice, (Re: Freedom 0: the utilitarian vs. the deontologist)

[Jean Louis]

On Thu, Mar 09, 2017 at 09:53:00PM +0100, Nomen Nescio wrote:
> > Indeed, and we are not required to make it work for everyone.
> 
> You've misunderstood the problem.  It's not that GNU Radio Foundation,
> Inc. is not taking actions to make something work, it's that GRFI has
> taken actions to break something that was working.  They have
> "stopped" tor wget users from making use of freedom 0.

It is sad to hear that "we are not required to make it work for
everyone". I understand it is personal opinion of Alfred, as I am sure
there is full intention by the FSF to make software available to
everyone.

While it is not directly relevant to Freedom 0 that a software package
cannot be downloaded in some cases, by using Tor, it is lack of policy
on FSF/GNU side, to permit GNU software to be distributed from such
freedom denying service providers such as CloudFlare.

Let us review what this page says on GNU.org website:
http://www.gnu.org/server/select-language.html?callback=/

Quoting:

If you're concerned about your privacy on the Web you can try the Tor
Browser Bundle available from https://torproject.org/. Among many
other improvements over generic browsers with regard to privacy, the
TBB comes configured to appear to be like a Windows-based, US-English
browser.

You're right that the language setting of your browser can be used by
some sites or third-parties to identify your specific browser and
target you for advertising. Tor provides the safest way we know to
avoid such targeting. Nevertheless, the GNU project does not use this
nor any other targeting methods, not even cookies (exception made of
the optional language override mentioned above): we simply care for
our users and have no interest in spying on you. The Accept-Language
header is a common way to localize contents according to user
preferences. You can learn more about it from the W3C.

End of quote.

"We simply care about our users and have no interest in spying on
you".

This alone is to show that there is a somewhat a lack of policy on
GNU/FSF side, on how this care is implemented. As it should not be
just implemented on www.gnu.org, rather it should stretch to all GNU
software equivale and consistently.

Finally, when Tor is recommended by GNU website, than Tor should be
allowed to access each and every GNU software piece.

Discarding this matter too easy "if it does not work for you, it is
not my problem" -- is simply not the solution.

Myself, I can hardly understand why GNU packages are spread around on
multiple sites. I was downloading many of them myself, and many
websites did not even work. Software get lost that way, some of
software become vaporware. It should rather have its place on GNU
servers.

CloudFlare is deteriorating the freedom to access the software, and it
should be good decision for GNU software NOT to host or use CloudFlare
services. 

Jean