Re: [gNewSense-users] Re: KFV back end / Code Review Programs

[Bake Timmons]

> Git is efficient, but also a real pain in the ass to work with
> (extremely nonobvious behavior - and this is coming to me from top
> percentile programmers (former OLPC colleagues), not newbies), and it is
> not (yet) well integrated with a bunch of other tools.
>
> As I recall this is partly because Linus wanted git to be more of a core
> library that others wrote front ends to, but I think he has since
> changed course, and is trying to make git easier to use. I'm not sure
> what the current state of that is, as I haven't touched git in >6 months.

OK, whatever is least painful. :)

> This seems like it's abstractable to "we need to maintain a database of
> information about a set of files that changes over time, and have nice
> front ends to maintaining that information". I have to think that there
> are - or really should be - nice Free Software products / sites covering
> that problem space. Fossology - http://fossology.org/ - was recently
> pointed out to me, but I haven't had a chance to look at it in depth yet.
>
> I have a few related memos circulating around the FSF offices about
> this, so soon I should have rms etc. opinions.

Great.  I tried Fossology (v. 0.6.0--it's now up to 0.9.0) on the
Linux kernel 2.6.24.  It is parallelizable, which matters a lot, since
its license-guessing capability (quite intriguing IMO) is extremely
CPU-intensive.  Few of its guesses were exactly right, but many were
close, and I think it would not be too much work to fix.  In any case,
even approximate results can be useful in some ways.

Although we could use its web interface, I am much more interested in
batch application.  Someone with SQL/postgresql (Fossology's RDMS)
skills could use Fossology's guesses to provide a way to doublecheck
(more trustworthy) human guesses.  Perhaps a better application
(again, using some database reporting) would be just to use Fossology
as a quick, rough, first pass and then follow up with (sporadic) human
confirmation.  Its guesses could be used to prioritize verification
activity, suggesting the most suspicious files to check first.  This
would be a win.

Of course, there will continue to be an interesting social value for
people learning certain things about source code.  For one thing, my
own KFV checking activity has helped me to not take the software I use
for granted as much as I used to.

> Also re: PFV, I just had a talk with Deb (IRC freedeb), maintainer of
> directory.fsf.org, and it turns out that there are plenty of cases where
> you need to look at every file with packages as well, or at least use
> some simple (grep/keyword) heuristics to scan through the files. She has
> some nice (but internally-focussed) write-ups on how she does that that
> may make it to the resources section of the FSF website in the fullness
> of time.

Yes, I suspected this was the case--it does seem strange to treat
non-kernel code so superficially; we might as well comb through
everything, particularly if we are much smarter with our tools.

>> I am eager to learn how web-based tools might help people.  In any
>> case, I will continue to be concerned with making the most productive
>> and transparent interface for freedom verification work.
>
> I think they make up for in number of people willing to use them what
> they lack in efficiency, and can also serve as a "gateway drug" to more
> efficient interfaces like kfv.el or whatever else people come up with.

Good point.

>
> Plus, you just know you want to see the freedom-verification version of
> http://futureoftheinternet.org/using-porn-to-solve-captchas !

:)