Log in

No account? Create an account
entries friends calendar profile Previous Previous Next Next
The problem of web services - Jef"I am the pusher robot"Spaleta
ramblings of the self-elected Fedora party whip
The problem of web services
I'm sure everyone has by now seen the Firefox EULA circus that is currently going on. We all love watching a good train wreck while its happening. I'm no different.

But I'm very concerned that for all the passion and media attention being expended over this particular EULA issue is all being misplaced. In our effort to ban together and pull down the Firefox EULA completely we very well maybe missing an opportunity to deal with a much bigger issue.

I would like to think that Chris Blizzards comments back in May when the issue hit Fedora-space still hold: http://blogs.gnome.org/hughsie/2008/05/23/firefox-eula/#comment-367

"Do you have specific concerns about the EULA? Other members of the Fedora community have already come up with a couple of points which we are working through. But I’m curious to know what you have to say about specific problems with it.

It’s largely there to inform the user that they have rights and includes a disclaimer of liability for some services that the browser uses. Liability limitation as a result of the code is covered by the software license but limits on liability for services is something else entirely, hence one of the reasons for the EULA."

I'd like to take Chris at his word, that the primary motivator here is about notifying users about the terms of web services that Mozilla is making available in association with Firefox. I can not stress this enough. Web services moving forward are going to continue to be a problem for "us." If we are intent on building a desktop experience which deeply integrates web services and we do not have some best practises framework in place on how to deal with terms of service notifications that service providers can rely on.

Is Mozilla handling it in the best way possible? Probably not. I don't expect anyone to get this stuff right without several attempts at it. But just because they are fumbling a bit over the issue..they shouldn't be knocked for attempting to address it. And sitting where I'm sitting (in my armchair, with beer in hand) I can't deny that Mozilla may have specific interests as a web service provider that I don't have a full grasp of. Certainly my layperson understanding of FLOSS copyright licensing does not transfer over the the realm of web services.

"We" as in everybody doing open source software has absolutely no fraking idea as to how to appropriately notify users about the services agreements associated with on-by-default web services. "We" collectively aren't giving it a lot of thought. "We" have this amorphous concept about the online desktop experience which is going to deeply integrate web services and enhance the day-to-day desktop user experience. But that enhancement comes at a cost..and that cost is the complication associated with "terms of service" for a vast array of different web service vendors. Just telling distributors to turn off the Mozilla services by default and ignore the issue now...just ends up pushing this discussion further and further out into the future. If we are serious about the online desktop meme, then "we" must expect that some services will be on by default for users, and "we" must make room with terms of service notifications. "We" can not continue to hide from this.

Where is the associated legal discussion about how to adequately notify users about the terms of such services? Such services and their terms are completely outside the scope of our collective layperson understanding of the copyright licensing which protect the rights to actual sourcecode running on clients in our ecosystem. Web services are not code... they are services...and new legal structures and best practises must be grown around their usage.

Out of all the people or groups actively working towards or is championing a linux desktop experience which deeply integrates web services.. which ones are making any effort at all to deal with the legal and usability issues associated with the "contract" notifications associated with those "web services?"

Right now I can point to Mozilla. Who else? Is the Gnome Foundation dealing with it? Are individual Gnome developers who are championing the online desktop experience thinking about it? Is Shuttleworth getting out in front and dealing with terms of service notification issues for the deeply integrated web-services he envisions Canonical providing at some point to desktop users?

The issue of web service contract term notifications isn't going to go away. The Mozilla situation is unfortunately overly complicated by other factors. But at the end of the day, when all of the current heat over the EULA issue falls away, we are probably still not going to be any closer to a shared understanding of how to deal with the terms of services of web services.
And that's really unfortunate.

16 comments or Leave a comment
From: bochecha.id.fedoraproject.org Date: September 17th, 2008 03:07 pm (UTC) (Link)
Unfortunately, I think you're right :/

However, this raises a few questions:
* if I can disagree with those licensing terms, the associated services should be automatically disabled right ? (we need to ensure that, this is not the case with the actual Fedora static page)
* what about users who don't want web services that impose some weird legal licenses to them ? Will they be faced each time with the EULA that they will have to read carefully to finally refuse it ?

And more importantly, when you install a software provided by Fedora, you are not shown the license so that you can agree or disagree. Why ? Because accepting the Fedora license implicitly signifies that you accept the licenses of all software provided by Fedora. Can't we imagine the same thing for web-services EULA ?

After all, an end-user doesn't care if it is a web-service or not, it will always be "the browser", and this browser is provided to him by Fedora. He already agreed to the Fedora license / EULA after installation, why is Fedora asking him to agree yet another EULA ?
jspaleta From: jspaleta Date: September 17th, 2008 04:23 pm (UTC) (Link)

part 1

All of these questions can be applied to any web services. Mozilla's browser specific webservice is just the first talking point. No one has put forward a framework that makes sense for a desktop paradigm with multiple web services from multiple vendors which are deeply integrated into the desktop experience.

But let me clear something up... the terms of web services are not software licenses... web services are NOT covered by copyright license. They are service contracts ...totally different than the copyright licenses. The GPL license which covers Fedora as a collective work of individual software components in the context of copyright... has absolutely no bearing on the terms of service that individual web service providers choose to use...and choose to change..without notice.

If other users like you have developed an expectation that the distribution's copyright license also applies to any web services at all which...then we've a damn long road to walk before distributions can comfortably put forth a deeply web integrated web experience.

There's a crapload of unexplored territory with regard to how to actually handle the legal gymnastics associated with web services.

When I see Mark Shuttleworth talk about the future of webservices in Jaunty Jackelope I cringe. Quoting https://lists.ubuntu.com/archives/ubuntu-devel-announce/2008-September/000481.html :"

"Another goal is the the blurring of web services and desktop
applications. "Is it a deer? Is it a bunny? Or is it a weblication - a
desktop application that seamlessly integrates the web!" This hare has
legs - and horns - and we'll be exploring it in much more detail for
Jaunty. We have already laid some foundations for weblications in the
online services discussions that took place in Prague, but since we
fully expect those services to ship in 9.04 the discussion will be that
much more intense in Mountain View."

Seriously, all of this talkity-talk about web services in such glowing tones, does not help the larger community figure out how we are going to handle the legal complications of seamlessly integrating them with applications. Web services are not source code. Mixing the "web" with "applications" into a "webplication" means you are in fact mixing the legal challenges of web services with the legal challenges of source code. Not the same... not by a long shot.

We've collectively come to some baseline understanding of how the source code license should work. Sure some people at Mozilla might need to be poked with the clue stick... but generally speaking...as a larger community we've developed a keen sense of smell with regard to copy right licensing terms and conditions. Sort of like how you pick the good pineapples from the bad ones in a store. We are giving Mozilla such a very hard time of the EULA precisely because we've sort of got the copyright licensing game figured out.

Now as it comes to web services all of that hard fought collective intuition is right out the window. Web services are not source code that gets distributed. Web services, being services, are not copyrightable and thus not subject to the protections of copyright licensing. Web services have "contract" terms which individual users may or may not need to see..but all users may want to see. Want/need/should which way do we handle the web service contract terms in these "webplications" of the future? Who is out there talking about what these means? Who's making the effort to actually communicate to end-users about the legal framework concerning web services.

jspaleta From: jspaleta Date: September 17th, 2008 04:24 pm (UTC) (Link)

part 2

Honestly, I don't see how we get from what I see going on with Mozilla right now... to "weblications" without a significant amount of discussion with end-users to build up some common understanding of how the terms of service are to be handled in the desktop UI so as they are "seamlessly integrated".

The Mozilla "experience" this week indicates to me at least, that integrating these things in a way that meets the legal needs of service providers may not actually be as seamless as some would like to see. And I'd really hate to see what's happening to Mozilla now, happen to the next web services provider who wants to attempt to "seamlessly integrate" a service with an application.

If I were working hard about creating a "webplication" and knew that I would have to expose the users of that to things such as a privacy policy and a web services terms of service contract...like Mozilla feels it needs to....I'd be thinking really hard about how to get out in front of this issue so that when it comes time to deploy the service and the application which connects to it, the terms of service notification are handled well enough to avoid the backlash that Mozilla is getting.

Because unless the communal understanding of what web services really require in terms of user notification gets better, we're gonna see this reaction again and again and again if we are headed towards "webplications."

From: bochecha.id.fedoraproject.org Date: September 17th, 2008 05:17 pm (UTC) (Link)

Re: part 2

Well, first of all, I'm not sure the road leading to webplications is the best one. I sincerely don't care about webservices, I want desktop application to run on my desktop, that's it. But of course, that's my own personal self opinion :)

However, what's happening right now with Mozilla could have been avoided by just making the web-services provided as an extension to the stock Firefox. Users would have understood it better that the EULA only applies to those web-services they are *themselves* trying to add.

IMHO, what created such a confusion is that the EULA was displayed on launching Firefox, this might mean that it covers Firefox. And we both know that even if users (we) really wanted to read EULAs, most of them (us) would not understand anything about this legalese jargon.

If the EULA only applies to the web-services, then it must be made very clear.

However, this doesn't solve the broader issue of integrating web-services in the desktop, as you're saying.

I don't see why we couldn't do the EULA stuff right after Fedora installation, along with the Fedora license / EULA. Users would see something like:
"All software available in Fedora is provided under the following licenses: ...
For a detailed explaination of each one, please see: fedoraproject.org/wiki/somewher-can't-remember-the-exact-place/Licenses

All web-services provided with Fedora are provided under EULAs that the user must agree. You should read the following EULAs that correspond to the web-services your installation has enabled:

Obviously, this should not be done in Firstboot if we want the user to be able to follow the links, but hey, that's already a problem with the current Fedora License / EULA.

I don't pretend that's the absoltely perfect solution, but I really don't see why it couldn't be a good one.
jspaleta From: jspaleta Date: September 17th, 2008 06:24 pm (UTC) (Link)

Re: part 2

You still fail to understand.

web services are by their very nature a "per user" sort of thing. They are not a "per install" sort of thing. At best you can pile all this stuff up into the first desktop login process. But still not really gonna work..because by installing optional "webplications" later all the users who on the system may need to agree to web service terms exposed by the newly installed "webplications."

And on top of that, web services providers can change their terms of service pretty much at any time..for any reason..and as a user you've got zero say in the matter.

Let's say that in the not so distance future, Canonical is providing a web service that "seemlessly" integrates with an upstream gnome application that most gnome desktops will be expected to have by default. I don't know maybe its a real time crude oil price tracking service or some sort of MSNBC news ticker service or something equally as indispensable.

What if at some point Canonical wants to share the ip addresses of the clients using that service with partners so that they can extend the available capabilities of the service in new ways, in ways those new service partners are experts at. Maybe its video, maybe its chat, maybe its smellovision. And maybe some people in the userbase aren't so cool with having their ip addresses shared with those partners.

This sort of sharing of information will of course need to have a documented service agreement which states that the service terms have changed, and users will need to be able to read it and decide if they want to continue using the service on a user by user basis. What's the mechanism that we are going make available to all service providers to communicate terms of service changes to individual users? Has anyone really put any thought into this at all?
How do we handle any of that... seamlessly?

From: kenciringione Date: October 17th, 2008 04:08 am (UTC) (Link)
Well, I don't know about you, but I don't think that's the change we need. Instead of offering a real plan to lower gas prices, the only energy proposal he's really promoting is more offshore drilling.
From: juliabirne Date: October 9th, 2008 03:09 pm (UTC) (Link)
If it's not at least one of these things, advertisers will struggle, whether it's on TV, a PC or a mobile device," he said.
From: todmayes Date: October 17th, 2008 03:37 am (UTC) (Link)
What are some examples of how you would like to see Google Maps laced into desktop applications. 2 Comments Towards a better dongle listen Wednesday September PM by Giles Turnbull Apple is a very image-conscious company.
From: shanestover Date: October 17th, 2008 12:24 am (UTC) (Link)
If both pieces of software come from the same vendor, it might have some special language and protocols that link the two together.
From: bernardomennel Date: October 17th, 2008 01:31 am (UTC) (Link)
If you refuse to accept the agreement, the software will not install. I always had a problem with Microsoft's liscensing agreements.
From: annaparance Date: October 17th, 2008 06:01 am (UTC) (Link)
If you possess infringing software but you did not know and you had no reason to believe that it is an infringing copy, you would not commit an offence.
From: ahmedsesny Date: October 17th, 2008 01:59 am (UTC) (Link)
After registering, and accepting an end user license agreement (EULA), you will be given two keys: one for general access and requests, and one for verification and signing of requests.
From: ivorymarsh Date: October 17th, 2008 02:41 am (UTC) (Link)
If you don't have one of the files, when you try to register it you will see a popup window that has this text: LoadLibrary("filename.
From: kevin_kofler Date: September 17th, 2008 07:20 pm (UTC) (Link)

Web services

This is actually an argument against that "online desktop" idea and a pretty strong one. Reliance on proprietary web services is eroding the freedom of our software and as you say this Mozilla issue is just one of the examples. But this means our software must not rely on any proprietary web service if it is to remain Free. And it should be noted that, as pointed out by the FSF, all web services relying on a single central server are effectively proprietary, even if they run on Free Software, because you don't control that server nor do you have the freedom to switch to another one.

So yes, the Mozilla web services should be turned off (if not patched out entirely), and so should all the others. At the very least the ones which require a EULA to be shown before being used.
jspaleta From: jspaleta Date: September 17th, 2008 07:50 pm (UTC) (Link)

Re: Web services

The problem here is, is that I don't think we have a collective understanding of how to do web services..at all.. even ones we'd like to think are "open."

None of this service oriented stuff is covered by copyright, its all contract law.. and we just don't have the same collective appreciation of the right way to handle service contracts. We don't have a blueprint.

And for all the crap Mozilla is getting over the EULA, if this is their best effort at a blueprint for web services... there is a extremely deep need to have an open discussion among multiple stakeholders about how to actually do this and do this well.

I do not trust Mozilla to get this right on their own.
I do not trust Gnome to get this right on their own
I do not trust Red Hat to get this right on their own.
I do not trust Canonical to get this right on their own.
I do not trust any individual developer to get this right on their own.
I'm not even sure I trust the FSF completely about what the legal position is.
I don't even trust myself to know what can be trusted.

Everybody, who has been talking about moving forward with an online desktop-like concept...needs to get together on an openly archived mailinglist and talk through this stuff. It could be invited participant only, to avoid some of the unnecessary heat over the issue, as long as its openly archived.

We've tried the private one-on-one discussions with Mozilla, its not clear its worked on so well. Everyone who is working on this stuff, needs to get into a room, on record for community review, and talk through the issues.

From: rooseveltalis Date: October 9th, 2008 03:11 pm (UTC) (Link)
We don't have a logo for instance. Tim: But how do you even pay attention to millions of user's suggestions with 23 employees.
16 comments or Leave a comment