LWN: Comments on "GNU Free Call"

GNU Free Call

spaetz — Wed, 23 Mar 2011 13:55:05 +0000

I have voiced scepticism about GNU Free Call before, but this is outright weird:

On March 14, the project was announced, having a US programmer and a Norwegian project coordinator. No code seems to exist yet, besides the sipwitch project.
On March 22, the Norwegian competence center for OSS and drivinkubator.no award the project 100k Crowns as "best eHealth solution using Free Software" in an annual competition. Err, when did they apply for this? And when did they code it?
The sipwitch project never had an email on its development list discussing or announcing (or even mentioning) GNU free call. The ONLY mail the list got in march 2011 was from an interested person who wanted to potentially join development. This mail remains without any reply so far.
The announcement post mentioned the gnucomm-privacy@gnu.org mailing list for core architecture discussion. It has not seen a mail in the last 6 months. The only mail to it was on March 16th with a question from an interested user (which has ... not seen a reply yet).

I don't want to imply malice, but if this were a project of a less sympathetic organization, I'd come up with price money skimming conspiracy theories :).

To their defense, I have to say that there is activity in the sipwitch code repository, and that I know how hard it is to react to emails while traveling. But this is extremly bad PR and project management at very least.

GNU Free Call

Velmont — Sun, 20 Mar 2011 19:07:07 +0000

Great comment. I agree. I also tested this two years ago. I wrote about it; Quick test of 5 FOSS Linux SIP softphones.

However, I tried Empathy last december, and it worked really well. So well, things have happened the last years.

Also, I found out that mumble will work for some small use cases (like office meetings etc).

GNU Free Call

magnus — Sun, 20 Mar 2011 17:28:21 +0000

Talk is cheap :)

GNU Free Call

foom — Thu, 17 Mar 2011 12:23:29 +0000

> I agree that sometimes a -lack- of after-the-fact proof is a good thing, but this specific reason for it (that someone could edit it and present a changed representation of what you said) doesn't apply since with a cryptographic signature, they could not. (not without being detected anyway)

I thought the purpose of that comment was to point out that showing a recorded phone call as evidence (which you might think was already pretty much nonrepudiatable, even without fancy crypto) is actually rather unreliable. So a good lawyer may be able to create enough uncertainty over whether it is in fact unmodified, even if in fact it is genuine, to get you off the hook for something.

GNU Free Call

ekj — Thu, 17 Mar 2011 10:15:11 +0000

Yes. But you can't have nonrepudiation without -also- having non-changeability.

That is, if you are unable to claim "it wasn't me", then the other guy is also unable to edit what you said and then claim "he said that".

I agree that sometimes a -lack- of after-the-fact proof is a good thing, but this specific reason for it (that someone could edit it and present a changed representation of what you said) doesn't apply since with a cryptographic signature, they could not. (not without being detected anyway)

GNU Free Call

paulj — Thu, 17 Mar 2011 09:20:35 +0000

You can have cryptographic authentication and verification of messages without, later, having proof the messages are unchanged. That's what OTR is about.

Re: Non-Repudiability

ekj — Thu, 17 Mar 2011 08:27:58 +0000

Is that really nessecarily so ?

Keep in mind that the crypto only proves that *someone* with a certain private key in their posession, was involved with the creation of the file. This is not the same thing at all as proving *you* did.

It's *very* important to remember this point. We crypto-nerds so often make claims like "the signature proves that you sent it" when in actual fact, it does nothing of the sort. It merely proves that someone with a certain private-key did.

And you could have lost or misplaced that any number of ways, or someone could've stolen a copy of it, without you noticing.

It's not a given that "this key signed it" is equivalent to "you did it" in a court of law.

Infact, I think it's entirely possible that your voice might be a stronger identifier. True it can be faked, but is it *really* obvious that faking a certain voice convincingly is easier than stealing a certain private-key ? It might be, or it might not, it's firmly in "it depends" land as far as I'm concerned.

GNU Free Call

ekj — Thu, 17 Mar 2011 08:22:49 +0000

Not with a cryptographic authenthication, they can't, no. If there's cryptographic proof that the conversation is genuine, then there's also cryptographic proof that it is unchanged.

GNU Free Call

spaetz — Wed, 16 Mar 2011 09:30:11 +0000

> That just does SIP, though, not the serverless peer-to-peer operation provided by Skype and promised by GNU Free Call.

I have never claimed otherwise and was referring to the requirements by my pre-poster:

>> existing (server-reliant) SIP client(s), that already supports encryption, and sufficient NAT tunnelling, and supports Linux, Windows and Mac, (and ideally video, which Skype has) -to polish it enough that I could actually recommend it to my friends and relatives over IM, & they download it, and it have a AT LEAST 50% chance of just working.(see below for what I've tried*)

That having said, I don't see yet why serverless is a must (as long as everyone can set up or chose from different servers).

GNU Free Call

mpr22 — Wed, 16 Mar 2011 08:56:13 +0000

Since I don't recognize elanthis's hyperbole in the "canonical" pronunciation of "GNU", the dictionary pronunciation of "gnu", the original pronunciation of the Afrikaans word from which it was derived, or any alternative pronunciation I find remotely plausible, my misanthropic tendencies quickly lead me to presume that elanthis has animosity towards GNU in the first place and this colours their attempts to pronounce its name.

GNU Free Call

nmav — Wed, 16 Mar 2011 08:24:02 +0000

Depends how they use gnupg. Typical communications protocols like IPSec, TLS and Datagram do not offer non-repudiation because it is too expensive.

GNU/Linux

jmm82 — Tue, 15 Mar 2011 22:59:43 +0000

For me it is:

intel/dell/Phoenix/grub/linux/dash/ubuntu/gnome/Chromium

but I tend to say Linux or even just Ubuntu.

GNU Free Call

josh — Tue, 15 Mar 2011 19:46:54 +0000

That just does SIP, though, not the serverless peer-to-peer operation provided by Skype and promised by GNU Free Call.

GNU Free Call

fb — Tue, 15 Mar 2011 12:36:32 +0000

You can't dictate how people will read a name.

The fact someone actually have to explain how to pronounce a name indicates (to me) that the name was not well chosen. If it is be used in an international environment full of people that speak English as a second language, it only gets worse.

Reminds me of the folks from MPICH who would constantly nag at anyone reading it as "m-pitch" instead of m.p.i.c.h. But then there is also KDE and all its projects who make any other naming choices sound good.

GNU Free Call

spaetz — Tue, 15 Mar 2011 12:06:36 +0000

I too wish them best of luck. If not just because I want to be using such a Skype-replacement.

However, I am a bit sceptical. I am one of those "Show me the code" people that judge merit based on what they see. And what I see here is a press release pointing to a project which had 2 mails in February and no mail in March on its list. Not exactly what I'd be calling a vibrant community. Also the mailing list neither discusses not mentions "GNU Free call".

If you try to actually find an online archive of the mailing list, or want to see the sipwitch code repository, it is very hard to find anything, as they only post links to source code tarballs. Only if you search sipwitch in GNU savannah, you will find links to archives and web interfaces.

I am not saying that this are issues that prevent them from being successfull or that they will not be successful, but it does feel like a single press release without previous bottom-up discussion or organization commitment. I hope I am wrong. Good luck!

GNU/Linux

vonbrand — Tue, 15 Mar 2011 12:00:13 +0000

For many, it would be more like "Firefox/Linux" or some such...

GNU Free Call

dr@jones.dk — Tue, 15 Mar 2011 11:55:52 +0000

Already working on that:

http://bugs.debian.org/618427

http://wiki.debian.org/FreedomBox/LeavingTheCloud

http://lists.alioth.debian.org/pipermail/freedombox-discu...

:-)

GNU Free Call

fb — Tue, 15 Mar 2011 11:41:08 +0000

Same here.

I make VoIP __video__ calls with family members who are not 'trained sysadmins'. At the end of the day, the only tool that works well is Skype.

Then there is the fact that for many people 'internet-video-calling' and 'Skype' are the same thing. Any other new choice would either have to be a lot better, or at lot easier to use. If Skype gets access to Facebook's contacts it will get even worse.

GNU Free Call

idupree — Tue, 15 Mar 2011 08:52:47 +0000

Ah, an active project I hadn't found! Nice! (It even includes encryption (SRTP).) No video, though. I'd try it, but Arch Linux doesn't seem to have it packaged currently, and I'm not in the mood to package it right now just to try it.

GNU Free Call

spaetz — Tue, 15 Mar 2011 08:32:37 +0000

For Linux and Mac, try blink (http://icanblink.com). Really nice and working very well for me.

GNU Free Call

mpr22 — Tue, 15 Mar 2011 08:01:46 +0000

(2) a horrifically ugly name that sounds like you're trying to gargle, spit, and sneeze all at the same time,

I'm sorry to have to say this, but your phonological hyperbole here goes far beyond ridiculous. If it was "ghnu", pronounced with a leading voiced velar fricative, I'd agree with you. It's not. It's "gnu", pronounced with a leading voiced velar plosive, the same sound used at the start of such unremarkable English words as "good", "green", and "go".

GNU/Linux

jrn — Tue, 15 Mar 2011 03:14:12 +0000

> On the other hand, "GNU/Linux" does rub me the wrong way.

"Glibc/Linux-based" or "Linux with GNU coreutils" would probably capture the intended meaning pretty well.

GNU Free Call

jiu — Tue, 15 Mar 2011 02:38:22 +0000

Whatever people say of the FSF, I think it's an awesome idea and wish them the best. The amount of functionality packed in skype won't be easy to duplicate (incl. call quality, ease of use etc...). In my experience nothing else comes close for personal voip.

GNU Free Call

Zack — Tue, 15 Mar 2011 01:38:01 +0000

>RMS and his organization at this point is more interested in trumping his ego rather than actually getting the word out to the common person. Why else would he argue vehemently that people use the longer and uglier "GNU/Linux" rather than, well, anything else?

Apparently because "the word" isn't always very clear in its supposed message, sometimes even opposed to it.
But aside from that I think everyone has already thought about and formed his or her opinion on the matter of GNU/Linux versus linux. And even if they didn't, I don't see how your post would be informative to them. I don't understand why you're dragging "the entire FSF/GNU movement" into this.

GNU Free Call

Zack — Tue, 15 Mar 2011 01:12:20 +0000

>Has the FSF really proven itself to be a strong technology incubator lately?

Not a very strong one, but Gnash, GNU classpath, and their pledge to the free Ryzom effort come to mind readily.

They seem to be limited to having to wait to see which proprietary software remains popular over longer periods of time and as such will hamper software freedom on the long term, and focus on those. In the current software landscape chasing everything that is popular at a particular moment isn't feasible for what is essentially an organization with very limited resources.

>I can't think of one in the past 5 years that's achieved any level of popularity.

The inherent problem with tackling long term popular proprietary solutions, is that they are already established. Fortunately the FSF is one of the few for whom "popularity" isn't a factor. Unfortunately, popularity is a good motivator to speed up a projects progress. In a way they're the only ones left who want to deal with the missing pieces noone else wants to bother with for a variety of reasons (too entrenched, already free enough, etc).

Re: Non-Repudiability

gmaxwell — Mon, 14 Mar 2011 23:34:49 +0000

Non-reputability breaks the ability to alter the content. It's a proof that someone with control of the private key signed the content. If I show up with a recording of you, and a hash of the recording signed by some private key I'll have a much easier time convincing someone that the recording is a complete, authentic, and unaltered recording of you than otherwise.

You don't have to want to be anonymous to want to avoid non-reputability. Anonymity is probably just as happy with authentication disabled in one direction or replaced with a single shot throw away 'identity'.

Often you just want to be able to say something without a nearly doubt-free fixed in stone record of it potentially being kept. This isn't because I expect that people are being sneaky, I just think that keeping formal authenticated non-reputable communication distinct. Or more importantly, going back to one of my initial points: Avoiding non-reputability on phone calls is important for preserving least surprise. People expect that encrypted phone calls are resistant to eavesdropping and that they're talking to the person they think they're talking to. They don't expect to be creating "signed" statement with every phone call. (and warning them might just make them abandon the eavesdropping resistance which they ought to have)

GNU Free Call

atai — Mon, 14 Mar 2011 23:33:39 +0000

Maybe this can integrate with the Freedom Box efforts...

Re: Non-Repudiability

DOT — Mon, 14 Mar 2011 23:09:20 +0000

Doesn't non-repudiability depend on the exact content? You can change the content, but then hashes don't match and it is repudiable again.

So what you have here, is a mathematically solid proof that someone said something. That can have problems in itself. You do want plausible deniability if you are using this service to remain anonymous.

GNU Free Call

hitmark — Mon, 14 Mar 2011 22:37:59 +0000

And Skype is also in talks with Facebook for deeper integration...

GNU Free Call

idupree — Mon, 14 Mar 2011 22:33:13 +0000

It might prove somewhat timely IF the project was to polish an existing (server-reliant) SIP client(s), that already supports encryption, and sufficient NAT tunnelling, and supports Linux, Windows and Mac, (and ideally video, which Skype has) -to polish it enough that I could actually recommend it to my friends and relatives over IM, & they download it, and it have a AT LEAST 50% chance of just working.(see below for what I've tried*)

Actually this GNU announcement is an announcement <<let's build this new peer-to-peer technology>>. Which will take a year at minimum. And provides almost none of the interoperability work that is necessary. And almost none of the advertising. Unless it has a million dollars to throw around, there's no ability to combine the research and the deployment efforts into one project. (And a million dollars still might be better spent on bringing all current and past VoIP developers to a conference together.)

*The Free state of the art has "almost" had this for, I think, two years, but:

Ekiga, like most, doesn't support encryption (or Mac) (etc.), SIP-Communicator is new (and didn't start for me last time I tried), WengoPhone/QuteCom isn't well enough funded to have fast development or always even work for me, Telepathy/Empathy froze my system a year or two ago when I tried to start an AV chat with a friend using the Google Talk client (I suppose I could try again -- but I won't be able to recommend Telepathy to non-Linux-using friends so I'll have no idea what clients they should use, nor how their GUIs work unless I'm sitting next to them -- which is not usually the time we're inspired to have an electronic chat), Twinkle works really nicely for me calling out from Linux via DiamondCard (& paying pennies) to the phone network but (1) is still on Qt3--no real development (2) is Linux-only so I can't tell my friends how to use it (3) no video; and for Mac, XMeeting bitrotted, and iChat uses a somewhat nonstandard combination of SIP and XMPP that Apple has not remedied and no Free client has implemented, and none of the 3-platform clients I tried a few months ago even worked for me making a test call on Linux. Except Skype. In fact, scrap encryption and decentralization-- I haven't been able to make a video call between me (Linux) and my parents (Mac), except with Skype, in years, and I do audio-only using the physical phone system (possibly with Twinkle on my end, possibly a real phone). We've tried a lot of things. It's quite possible we missed something, because there are so many possibilities to try. And it's twice as bad when working with non-tech-savvy friends who don't even know whether they're running Mac or Windows...

Here is one of the few pages I've found that even tries to document part of the above state-of-the-art:
http://wiki.ekiga.org/index.php/Ekiga_Interoperability

GNU Free Call

aliguori — Mon, 14 Mar 2011 22:15:59 +0000

Has the FSF really proven itself to be a strong technology incubator lately? Obviously, it's created a lot of important projects historically, but I can't think of one in the past 5 years that's achieved any level of popularity.

I think the FSF is an important organization, but I've seen a number of these projects announcement without things really materializing afterwards.

I'd be much more excited if this announcement came from the Apache Foundation, for instance. I think they have proven themselves to be a very strong technology incubator for Open Source software.

Re: Non-Repudiability

ldo — Mon, 14 Mar 2011 22:05:01 +0000

gmaxwell wrote:

Because someone can _trivially_ edit a recording to remove context, change order, etc. And it can be very difficult to show that it was modified one way or another.Because someone can _trivially_ edit a recording to remove context, change order, etc. And it can be very difficult to show that it was modified one way or another.

If thats the case, then the non-repudiability cannot prove anything about the content of the conversation, so whats the problem?

GNU Free Call

salimma — Mon, 14 Mar 2011 21:49:35 +0000

You can't blame the English language, since the FSF was founded in an English-speaking country by a native English speaker. He could have named it the Software Freedom Foundation, which is non-ambiguous.

The downside is that the term for the foundation and the term for the software won't match -- "freedom software" is as grammatically wrong as "freedom fries". "liberated software"? Since whatever else RMS would have chosen if it was not "free software", I'm sure it would not have been "open source"

GNU Free Call

jmm82 — Mon, 14 Mar 2011 20:51:34 +0000

There also appears to be a program free call already with the following slogan:

FreeCall | The cheapest freecalls on the planet!

Now I do not think even GNU can describe this type of free, "The cheapest freecalls"

GNU Free Call

AlexHudson — Mon, 14 Mar 2011 20:33:38 +0000

When you're whining about how someone named their project, it doesn't bolster your argument to also complain about how that same someone has no right to have an opinion on what names people use.

GNU Free Call

vonbrand — Mon, 14 Mar 2011 20:23:07 +0000

Sure, in English the term "Free Software" is ambiguous. Blame English, not the FSF for this misfeature.

On the other hand, "GNU/Linux" does rub me the wrong way. Not because I'd object to acknowledging the important part the GNU project plays in any Linux distribution, but because it downplays the efforts of many, many other projects (Xorg, the KDE project, stuff by the Apache foundation, pieces taken from the various BSDs, to mention just a few prominent ones).

GNU Free Call

gmaxwell — Mon, 14 Mar 2011 19:16:52 +0000

s/Repudiability/non-Repudiability/ and vice versa. :)

GNU Free Call

iabervon — Mon, 14 Mar 2011 18:33:41 +0000

Just because you're a party to a call doesn't mean that you'll necessarily talk during it. You might be joining a conference call with the rest of the National Transitional Council (of Libya) when you're an unacknowledged member and only listening. There's a good chance that the audio will become public, but you may need to conceal the fact that you were actually on the call at the time. There's also the possibility that you could participate in the conversation by text-to-speech in a generic voice.

For that matter, you might be an anonymous source reporting to Al Jazeera from the scene of a protest with audio from the street but never using your voice.

GNU Free Call

gmaxwell — Mon, 14 Mar 2011 18:09:48 +0000

Repudiability is a very useful thing, but it ought to be provided with the consent and the intention of the users.

People handle notarized documents differently from signed documents and those differently from phone calls. Converting every phone call to something in between a signed and a notarized document without the users understanding isn't a good thing, nor would it be good if people had to abandon confidentiality and mutual-authentication in order to avoid it. But it is certainly good to have non-repudiable communication available.

GNU Free Call

josh — Mon, 14 Mar 2011 17:19:49 +0000

Alternatively, this makes a good argument for non-repudiability. If you have cryptographic signatures preserving the integrity of the conversation, the other party can't present an edited recording without breaking the signatures. So, you can always present the original, unedited recording, together with the other party's signature.