Matthew Garrett calls for the private, secure desktop

We're bad at marketing

We can admit it, marketing is not our strong suit. Our strength is writing the kind of articles that developers, administrators, and free-software supporters depend on to know what is going on in the Linux world. Please subscribe today to help us keep doing that, and so we don’t have to get good at marketing.

Various contributors to the GNOME project gather in person multiple times a year for various hackathons and meetings around the globe, but there is still something different about the annual GUADEC conference. Reports from the project's teams, question-and-answer opportunities with board, and the sheer size of the turnout all combine to make it an unofficial assessment-and-strategic-planning event. At GUADEC 2014 in Strasbourg, France, Matthew Garrett took advantage of that opportunity in his keynote talk; issuing a bold challenge to the project to make user safety and security its paramount concern for future releases.

Garrett's keynote was entitled "Why do we desktop?"—and by "we" he meant, specifically, GNOME. First, he asked, "what is the desktop?" It runs on your computer, he said, there is a mouse, and you can click on things and get some things accomplished. But beyond those generic aspects, what people do on "desktop" computers today bears little resemblance to what they did on the first desktop systems a few decades ago. The earliest desktops, he said, were basically multiplexors for running several terminals, and even the first Windows releases centered around running existing DOS programs simultaneously: the emphasis was on providing quick access to multiple streams of information, but users still worked the way they had been working before windowing systems. Plus, he added, they could keep a clock running next to their applications.

Things changed considerably in the 1990s, he continued, as operating system vendors redesigned their desktops to take advantage of Internet access. This was not always a success: he called out Microsoft's Active Desktop effort, in which the desktop itself was supposed to provide integrated Internet access. It frequently crashed and proved confusing, but it was a bold experiment. Vendors and users had both realized that not all of the relevant information had to originate from local applications.

Not much changed for a few years afterward, he said. Desktops got shinier and added translucency; users still wanted to display clocks, and could add multiple clocks to their desktop (sporting exotic themes). Technical changes like hardware-accelerated compositing and special effects became possible. But even then, Linux did not really break into the market in a big way until Google launched its Chromebook and Chromebox projects. At that point, the meaning of desktop changed again: the Chrome OS desktop only exists so that you can open more browser windows, he said. In a sense it replicates the old multiple-terminals model: the desktop is just there to provide access to several browser windows at the same time.

Current reality and adaptation

But "how desktops work" was not the only factor undergoing change over the years, Garrett said. How companies want you to work has also changed—and, largely, not for the better. More and more of our work is bound to our ability to access remote systems. At the same time, people do more of their computing on devices outside of desktops. The big concern, though, is that the commercial operating system vendors see this and have adapted to it for their own advantage.

Microsoft, he said, is adapting by pushing a tightly unified user experience across all of its products. A Windows 8 desktop, Windows tablet, and Windows phone all look exactly the same; on a recent visit to a Microsoft campus, Garrett said, he even noticed that the physical signage on the buildings and the ID badges perfectly reproduced the new Windows style, even down to the aspect ratios.

Apple's response has been different. Mac OS X does not look very different today than it did a decade ago, and it is still distinct from iOS. Instead, Apple is pursuing integrating these disparate platforms by tying them in to the company's platform applications. iTunes is used to manage devices and the desktop alike. The company's App Store works on the iPhone and on a Mac; much of what a user does on a computer can be performed through core Apple applications like iTunes.

Google, too, is trying to integrate its various OS form factors, though it is doing so by tying them all into Google services. That is to say, Chrome OS and Android do not look much alike; the code bases do not use the same components, except for the kernel and a few other individual pieces. But they are all deeply linked into Google services.

The point that often seems to get missed, he said, is that none of these adaptations are actually focused on the needs of the user. The commercial vendors' moves are all geared toward selling more of the company's products—either selling things to the user, or, in the case of Google, selling the user's data to others. They are not designed to increase the user's productivity, he said, much less to preserve the user's privacy.

New world desktops

The trend of desktop designs focusing on revenue rather than user's needs is a problem free software is poised to fix, Garrett said. Furthermore, the world itself is changing in ways that make fixing this problem paramount. As people already know, there are criminals who make a steady living stealing financial information or breaking into systems, locking out the owner, and extorting ransom. And as people have discovered recently, government agencies are actually using desktop software as an avenue to spy on citizens. The concept angers people, he said, as it should. But the commercial OS vendors are ignoring it.

The proper response, Garrett said, is not to try to build "a better desktop" (than the competition); it is to build "a different desktop" that has a different set of priorities. Most of the priorities Garrett enumerated will likely not surprise free-software advocates.

A desktop must be secure, he said; if an attacker compromises LibreOffice, the attacker should not also gain access to all of the user's data. It must also respect and preserve privacy, he said. Integrating communication channels with Tor is good, but not enough. Everyone knows that applications themselves leak personal data, too. Applications should, instead, recognize a "privacy mode" requested by the desktop environment and respect it. They should also make it easy for the user to know that their privacy is being safeguarded. Finally, such a desktop must be open to inspection, so that it is auditable and so that users can see what happens when a flaw is discovered and corrected. "We should be embarrassed when we fail," he said, "then we should fix the flaw and move forward."

If there is to be a desktop that makes these principles its priority, Garrett said, that desktop should be GNOME. GNOME is free from corporate control, he said, which is not even the case for other free software desktop projects. It is also transparent; the designs, discussions, and decisions in the project are open for everyone to see. And GNOME is a diverse project. That makes it capable of serving the needs of users from anywhere in the world.

Garrett pointed out current discussions and work within GNOME that fit his list of priorities: application sandboxing and Wayland, for example, are both vital for security. Other priorities might take new work. GTK+ widgets and window decorations could be made to change their appearance or color in response to privacy-protection features, for instance.

Although the audience was, to be sure, on Garrett's side during the discussion of priorities, he ended his talk by making a more direct challenge to the project, asking who the "GNOME user" should be. The audience replied with a perhaps predictable "everyone," but Garrett pointed out that this goal in fact means addressing some users who are typically left out.

Those ignored users include web developers, for instance. Garrett noted that he recently attended an OpenStack event and saw that the majority of the developers were writing open source Python code on Linux, but doing so over SSH sessions from their Apple laptops. At home, they used those same laptops to watch video and listen to music content on a proprietary operating system. OS X is not helping these people do their work, he said, but just as importantly, GNOME is not serving them the rest of the day, and it should.

Similarly, he said, free software is usually dismissive of gamers who play proprietary games. Steam has solved a lot of the problems with getting and running games on a Linux desktop, he said, but GNOME needs to care about these users, too, even if those users are not aligned with free software's philosophy. "They deserve to be secure, too, and to have as much privacy as we can give them," he said. Their interest in running proprietary software does not make them less deserving of security and privacy.

Ultimately, he concluded, GNOME needs to look at as many users as possible, and serve them. A desktop project that says "you didn't watch the news last week and install all of the security updates released in response to that vulnerability? Too bad; it's your fault" is not serving the user. The project will face challenges if it attempts to push forward on these points, "but if we don't do this, who will?" he asked.

[The author would like to thank the GNOME Foundation for travel assistance to attend GUADEC 2014.]