[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
www/philosophy who-does-that-server-really-serv...
|
From: |
Richard M. Stallman |
|
Subject: |
www/philosophy who-does-that-server-really-serv... |
|
Date: |
Tue, 18 Jun 2013 04:38:47 +0000 |
CVSROOT: /web/www
Module name: www
Changes by: Richard M. Stallman <rms> 13/06/18 04:38:47
Modified files:
philosophy : who-does-that-server-really-serve.html
Log message:
Major rewrite.
Use "Service as a Software Substitute" instead of "Software as a
Service".
CVSWeb URLs:
http://web.cvs.savannah.gnu.org/viewcvs/www/philosophy/who-does-that-server-really-serve.html?cvsroot=www&r1=1.41&r2=1.42
Patches:
Index: who-does-that-server-really-serve.html
===================================================================
RCS file: /web/www/www/philosophy/who-does-that-server-really-serve.html,v
retrieving revision 1.41
retrieving revision 1.42
diff -u -b -r1.41 -r1.42
--- who-does-that-server-really-serve.html 6 Jun 2013 16:34:58 -0000
1.41
+++ who-does-that-server-really-serve.html 18 Jun 2013 04:38:47 -0000
1.42
@@ -9,13 +9,23 @@
<p>by <strong>Richard Stallman</strong></p>
-<p>(First published
-by <a href="http://www.bostonreview.net/richard-stallman-free-software-DRM";>
-Boston Review</a>.)</p>
+<blockquote>(The first version was published
+in <a href="http://www.bostonreview.net/richard-stallman-free-software-DRM";>
+Boston Review</a>.)</blockquote>
<p><strong>On the Internet, proprietary software isn't the only way to
-lose your freedom. Software as a Service is another way to let
-someone else have power over your computing.</strong></p>
+lose your freedom. Service as a Software Substitute, or SaaSS, is
+another way to let someone else have power over your
+computing.</strong></p>
+
+SaaSS means using a service implemented by someone else as a
+substitute for running your copy of a program. The term is ours;
+articles and ads won't use it, and they won't tell you whether a
+service is SaaSS. Instead they will probably use the vague and
+distracting term “cloud”, which lumps SaaSS together with
+various other practices, some abusive and some ok. With the
+explanation and examples in this page, you can tell whether a service
+is SaaSS.
<h3>Background: How Proprietary Software Takes Away Your Freedom</h3>
@@ -41,221 +51,283 @@
<p>With free software, we, the users, take back control of our
computing. Proprietary software still exists, but we can exclude it
from our lives and many of us have done so. However, we now face a
-new threat to our control over our computing: Software as a Service.
-For our freedom's sake, we have to reject that too.</p>
-
-<h3>How Software as a Service Takes Away Your Freedom</h3>
-
-<p>Software as a Service (SaaS) means that someone sets up a network
-server that does certain computing tasks—running spreadsheets,
-word processing, translating text into another language,
-etc.—then invites users to do their computing on that server.
-Users send their data to the server, which does their computing on the
-data thus provided, then sends the results back or acts on them
-directly.</p>
+new threat to our control over our computing: Service as a Software
+Substitute (SaaSS). For our freedom's sake, we have to reject that
+too.</p>
+
+<h3>How Service as a Software Substitute Takes Away Your Freedom</h3>
+
+<p>Service as a Software Substitute (SaaSS) means using a service as a
+substitute for running your copy of a program. Concretely, it means
+that someone sets up a network server that does certain computing
+tasks—for instance, modifying a photo, translating text into
+another language, etc.—then invites users to do computing via
+that server. A user of the server would send her data to the server,
+which does <em>her own computing</em> on the data thus provided, then
+sends the results back to her or acts directly on her behalf.</p>
+
+<p>The computing is <em>her own</em> because, by assumption, she
+could, in principle, have done it by running a program on her own
+computer (whether or not that program is available to her at
+present). When this assumption is not so, it isn't SaaSS.</p>
<p>These servers wrest control from the users even more inexorably
than proprietary software. With proprietary software, users typically
-get an executable file but not the source code. That makes it hard
-for programmers to study the code that is running, so it's hard to
-determine what the program really does, and hard to change it.</p>
-
-<p>With SaaS, the users do not have even the executable file: it is on
-the server, where the users can't see or touch it. Thus it is
-impossible for them to ascertain what it really does, and impossible
-to change it.</p>
-
-<p>Furthermore, SaaS automatically leads to harmful consequences
-equivalent to the malicious features of certain proprietary software.
-For instance, some proprietary programs are “spyware”: the
-program sends out data about users' computing activities. Microsoft
-Windows sends information about users' activities to Microsoft.
-Windows Media Player and RealPlayer report what each user watches or
-listens to.</p>
+get an executable file but not the source code. That makes it hard to
+study the code that is running, so it's hard to determine what the
+program really does, and hard to change it.</p>
+
+<p>With SaaSS, the users do not have even the executable file that
+does their computing: it is on someone else's server, where the users
+can't see or touch it. Thus it is impossible for them to ascertain
+what it really does, and impossible to change it.</p>
+
+<p>Furthermore, SaaSS automatically leads to consequences equivalent
+to the malicious features of certain proprietary software.</p>
+
+<p> For instance, some proprietary programs are “spyware”:
+the program sends out data about users' computing activities.
+Microsoft Windows sends information about users' activities to
+Microsoft. Windows Media Player reports what each user watches or
+listens to. The Amazon Kindle reports which pages of which books the
+user looks at, and when. Angry Birds reports the user's geolocation
+history.</p>
-<p>Unlike proprietary software, SaaS does not require covert code to
+<p>Unlike proprietary software, SaaSS does not require covert code to
obtain the user's data. Instead, users must send their data to the
server in order to use it. This has the same effect as spyware: the
-server operator gets the data. He gets it with no special effort, by
-the nature of SaaS.</p>
+server operator gets the data — with no special effort, by
+the nature of SaaSS.</p>
-<p>Some proprietary programs can mistreat users under remote command.
-For instance, Windows has a back door with which Microsoft can
-forcibly change any software on the machine. The Amazon Kindle e-book
-reader (whose name suggests it's intended to burn people's books) has
-an Orwellian back door that Amazon used in 2009
-to <a
href="http://www.nytimes.com/2009/07/18/technology/companies/18amazon.html";
->remotely delete</a> Kindle copies of Orwell's books <cite>1984</cite> and
-<cite>Animal Farm</cite> which the users had purchased from Amazon.</p>
-
-<p>SaaS inherently gives the server operator the power to change the
-software in use, or the users' data being operated on. Once again, no
-special code is needed to do this.</p>
-
-<p>Thus, SaaS is equivalent to total spyware and a gaping wide back
-door, and gives the server operator unjust power over the user. We
-can't accept that.</p>
-
-<h3>Untangling the SaaS Issue from the Proprietary Software Issue</h3>
-
-<p>SaaS and proprietary software lead to similar harmful results, but
-the causal mechanisms are different. With proprietary software, the
-cause is that you have and use a copy which is difficult or illegal to
-change. With SaaS, the cause is that you use a copy you don't
-have.</p>
+<p>Some proprietary operating systems have a universal back door,
+permitting someone to remotely install software changes. For
+instance, Windows has a universal back door with which Microsoft can
+forcibly change any software on the machine. Nearly all portable
+phones have them, too. Some proprietary applications also have
+universal back doors; for instance, the Steam client for GNU/Linux
+allows the developer to remotely install modified versions.</p>
+
+<p>With SaaSS, the server operator can change the software in use on
+the server. He ought to be able to do this, since it's his computer;
+but the result is the same as using a proprietary application program
+with a universal back door: someone has the power to silently impose
+changes in how the user's computing gets done.</p>
+
+<p>Thus, SaaSS is equivalent to running proprietary software with
+spyware and a universal back door. It gives the server operator
+unjust power over the user, and that power is something we must
+resist.</p>
+
+<h3>SaaSS and SaaS</h3>
+
+<p>Originally we referred to this problematical practice as “
+SaaS ”, which stands for “ Software as a Service ”.
+It's a commonly used term for setting up software on a server rather
+than offering copies of it to users, and we thought it described
+precisely the cases where this problem occurs.</p>
+
+<p>Subsequently we became aware that the term SaaS is sometimes used
+for communication services — activities for which this issue is
+not applicable. In addition, the term “ Software as a Service
+” doesn't explain <em>why</em> the practice is bad. So we
+coined the term “ Service as a Software Substitute ”,
+which defines the bad practice more clearly and says what is bad
+about it.
+
+<h3>Untangling the SaaSS Issue from the Proprietary Software Issue</h3>
+
+<p>SaaSS and proprietary software lead to similar harmful results, but
+the mechanisms are different. With proprietary software, the
+mechanism is that you have and use a copy which is difficult and/or
+illegal to change. With SaaSS, the mechanism is that you don't have
+the copy that's doing your computing.</p>
<p>These two issues are often confused, and not only by accident. Web
developers use the vague term “web application” to lump
the server software together with programs run on your machine in your
-browser. Some web pages install nontrivial or even large JavaScript
-programs temporarily into your browser without informing
+browser. Some web pages install nontrivial, even large JavaScript
+programs into your browser without informing
you. <a href="/philosophy/javascript-trap.html">When these JavaScript
-programs are nonfree</a>, they are as bad as any other nonfree
-software. Here, however, we are concerned with the problem of the
-server software itself.</p>
+programs are nonfree</a>, they are the same sort of problem as any
+other nonfree software. Here, however, we are concerned with the
+problem of the server software itself.</p>
-<p>Many free software supporters assume that the problem of SaaS will
+<p>Many free software supporters assume that the problem of SaaSS will
be solved by developing free software for servers. For the server
operator's sake, the programs on the server had better be free; if
they are proprietary, their owners have power over the server. That's
-unfair to the operator, and doesn't help you at all. But if the
-programs on the server are free, that doesn't protect you <em>as the
-server's user</em> from the effects of SaaS. They give freedom to the
-operator, but not to you.</p>
+unfair to the operator, and doesn't help the users at all. But if the
+programs on the server are free, that doesn't protect <em>the server's
+users</em> from the effects of SaaSS. These programs liberate the
+server operator, but not the server's users.</p>
<p>Releasing the server software source code does benefit the
-community: suitably skilled users can set up similar servers, perhaps
-changing the software. But none of these servers would give you
-control over computing you do on it, unless it's <em>your</em> server.
-The rest would all be SaaS. SaaS always subjects you to the power of
-the server operator, and the only remedy is, <em>Don't use SaaS!</em>
-Don't use someone else's server to do your own computing on data
-provided by you.</p>
-
-<h3>Distinguishing SaaS from Other Network Services</h3>
-
-<p>Does avoiding SaaS mean you refuse to use any network servers run
-by anyone other than you? Not at all. Most servers do not raise this
-issue, because the job you do with them isn't your own computing
-except in a trivial sense.</p>
-
-<p>The original purpose of web servers wasn't to do computing for you,
-it was to publish information for you to access. Even today this is
-what most web sites do, and it doesn't pose the SaaS problem, because
-accessing someone's published information isn't a matter of doing your
-own computing. Neither is publishing your own materials via a blog
-site or a microblogging service such as Twitter or identi.ca. The
-same goes for communication not meant to be private, such as chat
-groups. Social networking can extend into SaaS; however, at root it
-is just a method of communication and publication, not SaaS. If you
-use the service for minor editing of what you're going to communicate,
-that is not a significant issue.</p>
+community: it enables suitably skilled users to set up similar
+servers, perhaps changing the
+software. <a href="/licenses/license-recommendations.html"> We
+recommend using the GNU Affero GPL</a> as the license for programs
+often used on servers.</p>
+
+<p>But none of these servers would give you control over computing you
+do on it, unless it's <em>your</em> server. It may be OK to trust
+your friend's server for some jobs, just as you might let your friend
+maintain the software on your own computer. Outside of that, all
+these servers would be SaaSS for you. SaaSS always subjects you to
+the power of the server operator, and the only remedy is, <em>Don't
+use SaaSS!</em> Don't use someone else's server to do your own
+computing on data provided by you.</p>
+
+<h3>Distinguishing SaaSS from Other Network Services</h3>
+
+<p>Which online services are SaaSS? The clearest example is a
+translation service, which translates (say) English text into Spanish
+text. Translating a text for you is computing that is purely yours.
+You could do it by running a program on your own computer, if only you
+had the right program. (To be ethical, that program should be free.)
+The translation service substitutes for that program, so it is Service
+as a Software Substitute, or SaaSS. Since it denies you control
+over your computing, it does you wrong.</p>
+
+<p>Another clear example is using a service such as Flickr or
+Instagram to modify a photo. Modifying photos is an activity that
+people have done in their own computers for decades; doing it in a
+server instead of your own computer is SaaSS.</p>
+
+<p>Rejecting SaaSS does not mean refusing to use any network servers
+run by anyone other than you. Most servers are not SaaSS because the
+jobs they do are not the user's own computing.</p>
+
+<p>The original idea of web servers wasn't to do computing for you, it
+was to publish information for you to access. Even today this is what
+most web sites do, and it doesn't pose the SaaSS problem, because
+accessing someone's published information isn't doing your own
+computing. Neither is publishing your own materials via a blog site
+or a microblogging service such as Twitter or StatusNet. (These
+services may have other problems, of course.) The same goes for other
+communication not meant to be private, such as chat groups.</p>
+
+<p>In its essence, social networking is a form of communication and
+publication, not SaaSS. However, a service whose main facility is
+social networking can have features or extensions which are SaaSS.</p>
+
+<p>If a service is not SaaSS, that does not mean it is OK. There are
+other ethical issues about services. For instance, Facebook
+distributes video in Flash, which pressures users to run nonfree
+software; it requires running nonfree JavaScript code; and it gives
+users a misleading impression of privacy while luring them into baring
+their lives to Facebook. Those are important issues, different from
+the SaaSS issue.
+</p>
<p>Services such as search engines collect data from around the web
and let you examine it. Looking through their collection of data
isn't your own computing in the usual sense—you didn't provide
that collection—so using such a service to search the web is not
-SaaS. (However, using someone else's search engine to implement a
-search facility for your own site <em>is</em> SaaS.)</p>
+SaaSS. However, using someone else's server to implement a search
+facility for your own site <em>is</em> SaaSS.</p>
-<p>E-commerce is not SaaS, because the computing isn't solely yours;
-rather, it is done jointly for you and another party. So there's no
-particular reason why you alone should expect to control that
-computing. The real issue in e-commerce is whether you trust the
-other party with your money and personal information.</p>
-
-<p>Using a joint project's servers isn't SaaS because the computing
-you do in this way isn't yours personally. For instance, if you edit
-pages on Wikipedia, you are not doing your own computing; rather, you
-are collaborating in Wikipedia's computing.</p>
-
-<p>Wikipedia controls its own servers, but groups can face the problem
-of SaaS if they do their group activities on someone else's server.
-Fortunately, development hosting sites such as Savannah and
-SourceForge don't pose the SaaS problem, because what groups do there
-is mainly publication and public communication, rather than their own
-private computing.</p>
-
-<p>Multiplayer games are a group activity carried out on someone
-else's server, which makes them SaaS. But where the data involved is
-just the state of play and the score, the worst wrong the operator
-might commit is favoritism. You might well ignore that risk, since it
-seems unlikely and very little is at stake. On the other hand, when
-the game becomes more than just a game, the issue changes.</p>
-
-<p>“Backend as a Service”, or BaaS, is a kind of SaaS, because it
-involves running your own web service on top of software that you
-can't control. If you set up a service using BaaS, the BaaS platform
-may well collect information about your users as well as you.</p>
-
-<p>Which online services are SaaS? Google Docs is a clear example.
-Its basic activity is editing, and Google encourages people to use it
-for their own editing; this is SaaS. It offers the added feature of
-collaborative editing, but adding participants doesn't alter the fact
-that editing on the server is SaaS. (In addition, Google Docs is
-unacceptable because it installs a
-large <a href="/philosophy/javascript-trap.html"> nonfree JavaScript
program</a>
-into the user's browser.) If using a service for communication or
-collaboration requires doing substantial parts of your own computing
-with it too, that computing is SaaS even if the communication is
-not.</p>
-
-<p>Some sites offer multiple services, and if one is not SaaS, another
-may be SaaS. For instance, the main service of Facebook is social
-networking, and that is not SaaS; however, it supports third-party
-applications, some of which may be SaaS. Flickr's main service is
-distributing photos, which is not SaaS, but it also has features for
-editing photos, which is SaaS.</p>
-
-<p>Some sites whose main service is publication and communication
-extend it with “contact management”: keeping track of
-people you have relationships with. Sending mail to those people for
-you is not SaaS, but keeping track of your dealings with them, if
-substantial, is SaaS.</p>
-
-<p>If a service is not SaaS, that does not mean it is OK. There are
-other bad things a service can do. For instance, Facebook distributes
-video in Flash, which pressures users to run nonfree software, and it
-gives users a misleading impression of privacy. Those are important
-issues too, but this article's concern is the issue of SaaS.</p>
-
-<p>The IT industry discourages users from considering these
-distinctions. That's what the buzzword “cloud computing”
-is for. This term is so nebulous that it could refer to almost any
-use of the Internet. It includes SaaS and it includes nearly
-everything else. The term only lends itself to uselessly broad
-statements.</p>
-
-<p>The real meaning of “cloud computing” is to suggest a
-devil-may-care approach towards your computing. It says, “Don't
-ask questions, just trust every business without hesitation. Don't
+<p>Purchasing online is not SaaSS, because the computing
+isn't <em>your own</em>; rather, it is done jointly by and for you and
+the store. The real issue in online shopping is whether you trust the
+other party with your money and other personal information (starting
+with your name).</p>
+
+<p>Repository sites such as as Savannah and SourceForge are not
+inherently SaaSS, because a repository's job is publication of data
+supplied to it.</p>
+
+<p>Using a joint project's servers isn't SaaSS because the computing
+you do in this way isn't your own. For instance, if you edit pages on
+Wikipedia, you are not doing your own computing; rather, you are
+collaborating in Wikipedia's computing. Wikipedia controls its own
+servers, but organizations as well as individuals encounter the
+problem of SaaSS if they do their computing in someone else's
+server.</p>
+
+<p>Some sites offer multiple services, and if one is not SaaSS,
+another may be SaaSS. For instance, the main service of Facebook is
+social networking, and that is not SaaSS; however, it supports
+third-party applications, some of which are SaaSS. Flickr's main
+service is distributing photos, which is not SaaSS, but it also has
+features for editing photos, which is SaaSS. Likewise, using
+Instagram to post a photo is not SaaSS, but using it to transform the
+photo is SaaSS.</p>
+
+<p>Google Docs shows how complex the evaluation of a single service
+can become. It invites people to edit a document by running a
+large <a href="/philosophy/javascript-trap.html">nonfree JavaScript
+program</a>, clearly wrong. However, it offers an API for uploading
+and downloading documents in standard formats. A free software editor
+can do so through this API. This usage scenario is not SaaSS, because
+it uses Google Docs as a mere repository. Showing all your data to a
+company is bad, but that is a matter of privacy, not SaaSS; depending
+on a service for access to your data is bad, but that is a matter of
+risk, not SaaSS. On the other hand, using the service for converting
+document formats <em>is</em> SaaSS, because it's something you could
+have done by running a suitable program (free, one hopes) in your own
+computer.</p>
+
+<p>Using Google Docs through a free editor is rare, of course. Most
+often, people use it through the nonfree JavaScript program, which is
+bad like any nonfree program. This scenario might involve SaaSS, too;
+that depends on what part of the editing is done in the JavaScript
+program and what part in the server. We don't know, but since SaaSS
+and proprietary software do similar wrong to the user, it is not
+crucial to know.</p>
+
+<p>Publishing via someone else's repository does not raise privacy
+issues, but publishing through Google Docs has a special problem: it
+is impossible even to <em>view the text</em> of a Google Docs document
+in a browser without running the nonfree JavaScript code. Thus, you
+should not use Google Docs to publish anything — but the reason
+is not a matter of SaaSS.</p>
+
+<p>The IT industry discourages users from making these distinctions.
+That's what the buzzword “cloud computing” is for. This
+term is so nebulous that it could refer to almost any use of the
+Internet. It includes SaaSS as well as many other network usage
+practices. In any given context, an author who writes
+“cloud” (if a technical person) probably has a specific
+meaning in mind, but usually does not explain that in other articles
+the term has other specific meanings. The term leads people to
+generalize about practices they ought to consider individually.</p>
+
+<p>If “cloud computing” has a meaning, it is not a way of
+doing computing, but rather a way of thinking about computing: a
+devil-may-care approach which says, “Don't ask questions. Don't
worry about who controls your computing or who holds your data. Don't
-check for a hook hidden inside our service before you swallow
-it.” In other words, “Think like a sucker.” I prefer
-to avoid the term.</p>
+check for a hook hidden inside our service before you swallow it.
+Trust companies without hesitation.” In other words, “Be a
+sucker.” A cloud in the mind is an obstacle to clear thinking.
+For the sake of clear thinking about computing, let's avoid the term
+“cloud.”</p>
-<h3>Dealing with the SaaS Problem</h3>
+<h3>Dealing with the SaaSS Problem</h3>
-<p>Only a small fraction of all web sites do SaaS; most don't raise
+<p>Only a small fraction of all web sites do SaaSS; most don't raise
the issue. But what should we do about the ones that raise it?</p>
<p>For the simple case, where you are doing your own computing on data
-in your own hands, the solution is simple: use your own copy of a free software
-application. Do your text editing with your copy of a free text
-editor such as GNU Emacs or a free word processor. Do your photo
-editing with your copy of free software such as GIMP.</p>
-
-<p>But what about collaborating with other individuals? It may be
-hard to do this at present without using a server. If you use one,
-don't trust a server run by a company. A mere contract as a customer
-is no protection unless you could detect a breach and could really
-sue, and the company probably writes its contracts to permit a broad
-range of abuses. Police can subpoena your data from the company with
-less basis than required to subpoena them from you, supposing the
-company doesn't volunteer them like the US phone companies that
-illegally wiretapped their customers for Bush. If you must use a
-server, use a server whose operators give you a basis for trust beyond
-a mere commercial relationship.</p>
+in your own hands, the solution is simple: use your own copy of a free
+software application. Do your text editing with your copy of a free
+text editor such as GNU Emacs or a free word processor. Do your photo
+editing with your copy of free software such as GIMP. What if there
+is no free program available? A proprietary program or SaaSS would
+take away your freedom, so you shouldn't use those. You can contribute
+your time or your money to development of a free replacement.</p>
+
+<p>What about collaborating with other individuals as a group? It may
+be hard to do this at present without using a server, and your group
+may not know how to run its own server. If you use someone else's
+server, at least don't trust a server run by a company. A mere
+contract as a customer is no protection unless you could detect a
+breach and could really sue, and the company probably writes its
+contracts to permit a broad range of abuses. The state can subpoena
+your data from the company along with everyone else's, as Obama has
+done to phone companies, supposing the company doesn't volunteer them
+like the US phone companies that illegally wiretapped their customers
+for Bush. If you must use a server, use a server whose operators give
+you a basis for trust beyond a mere commercial relationship.</p>
<p>However, on a longer time scale, we can create alternatives to
using servers. For instance, we can create a peer-to-peer program
@@ -270,12 +342,12 @@
free software projects to consider this issue in their design.</p>
<p>In the meantime, if a company invites you to use its server to do
-your own computing tasks, don't yield; don't use SaaS. Don't buy or
+your own computing tasks, don't yield; don't use SaaSS. Don't buy or
install “thin clients”, which are simply computers so weak
-they make you do the real work on a server, unless you're
-going to use them with <em>your</em> server. Use a real
-computer and keep your data there. Do your work with your own copy of
-a free program, for your freedom's sake.</p>
+they make you do the real work on a server, unless you're going to use
+them with <em>your</em> server. Use a real computer and keep your
+data there. Do your own computing with your own copy of a free
+program, for your freedom's sake.</p>
<h3>See also:</h3>
<p><a href="/philosophy/bug-nobody-allowed-to-understand.html">The
@@ -299,7 +371,7 @@
README</a> for information on coordinating and submitting translations
of this article.</p>
-<p>Copyright © 2010 Richard Stallman
+<p>Copyright © 2010, 2013 Richard Stallman
<br />
This page is licensed under a <a rel="license"
href="http://creativecommons.org/licenses/by-nd/3.0/us/";>Creative
@@ -310,7 +382,7 @@
<p>Updated:
<!-- timestamp start -->
-$Date: 2013/06/06 16:34:58 $
+$Date: 2013/06/18 04:38:47 $
<!-- timestamp end -->
</p>
</div>