FOSS

Last week I set up a kind of personal music streaming service. It’s a way for me to access my own music collection—some 50,000 songs—from an interface that is functionally identical to the major music apps like Apple Music or Spotify. When I open the app on my phone, it streams a song directly from the hard drive at my house to wherever I am, whether I’m connected to WiFi or just the cellular network. There is nothing in the cloud, no third-party data collection about my listening habits, no subscription, and no permissions other than the username/password I set up for myself. If I buy a record and add the files to my storage drive, the application re-syncs and the album appears immediately for listening. For the privilege of accessing my own files from anywhere in the world via a convenient mobile interface, I paid the tidy sum of zero dollars, which is to say I did not pay anything at all.

This essay will not describe in detail how to do this. It takes some technical understanding, but if you want to learn, there are more than a few online resources available for that as well as myriad software options different than what I’m using. You need a basic understanding of the server/client relationship, the way that computers communicate and exchange information with each other (viz. networking), and some spare hardware like an old computer. A good starting place for ideas is the subreddit r/selfhosted.

Instead, I’d like to offer a primer on why I think it’s important to reclaim some digital autonomy, particularly in today’s world. This article is for anyone who is exasperated by software subscriptions, who has paid for access to a piece of media that is no longer available to them, or who just might throw their computer out the window if they have to spend another second selecting tiny pictures of streetlights, crosswalks, or bicycles. It’s also for people like me who cannot shake the nagging sense that any exchange of money for any digital service whatsoever increasingly fuels environmental destruction, capitalist exploitation, and the creep of authoritarianism. More on that later.

The acronym FOSS stands for “Free, Open-Source Software.” The “free” part should be clear; the “open-source” part means that the code that was written that comprises the software—the “source code”—is published for anyone to look at, copy, modify, etc. In other words, it’s not copyrighted. The idea that a software tool can or should be free is far from new—in fact, it’s the foundation of all modern computing, even in profit-seeking, proprietary products. The below screenshot sums up this idea in a single tweet better than I can in a whole essay:

This is tongue-in-cheek, of course, but the sentiment is absolutely spot-on. For a real-world example, take something like Netflix: they may have designed a glitzy website full of expensive trademarked branding and content for which they’ve paid billions of dollars, but the core technical undergirding of their entire enterprise is FFmpeg, a free, open-source piece of software invented 26 years ago that efficiently encodes/decodes streaming media. In fact, all online video streaming is achieved with FFmpeg—because why would you re-invent the wheel when the perfect wheel already exists and is free to use?

If you scratch the surface of software development, you will inevitably discover that the decades-old dream of an egalitarian, equitable cyber-utopia is still very much alive and thriving, driven partly by selfless individual pioneers like the fictional Ronald and partly by corporations with vested interests. While both sides have been historically important (the earliest operating systems were developed by companies like AT&T and IBM), it’s the latter actors that tend to obscure the bevy of available tools because it would be much better for them if you thought you needed to pay for something that is already free. It’s also these corporations that have lately been throwing their weight around to align more with authoritarian governments than their own users. I’ll get to that.

The fact is, for almost every “closed-source” product, there is an open-source alternative. Instead of paying for a Windows license, you can use Linux for free. Instead of paying for a Microsoft 365 subscription, you can use LibreOffice. Instead of paying for a Photoshop subscription, you can use GIMP. Instead of ProTools, there is Ardour, and so on. Open-source tools are often remarkably free from the trap of enshittification because there is no profit incentive behind their development. Being designed as intentional alternatives, these tools are usually able to work with and save pesky proprietary file formats that can continue to be worked on in their native applications. Of course, there will always be exceptions; some open-source software is crude and buggy, and some software tools are simply worth paying for, and that’s OK too.

But for people that are new to this concept, I think it’s important to address some myths and misunderstandings.

The first and perhaps most common misunderstanding about open-source software is that its “openness” makes it less safe than the closed-source alternative. This couldn’t be further from the truth, and here’s why:

Remember that “open-source” means that the source code that comprises the software is openly published and copyright-free. This is not the same thing as your data being openly published. If I use an open-source word processor like LibreOffice to write a death threat, it’s not like that text is automatically uploaded to the internet and published alongside the source code of LibreOffice. In fact, open-source developers are just as capable of integrating the most powerful data encryption and secret-keeping tools known to the world into their products, mainly because those tools themselves, like encryption algorithms, are open-source—go figure!

The crucial difference here is that if the developer has made a mistake at any point along the way (like a sloppy implementation of encryption standards), the community of users is capable of auditing the code, discovering the mistake, patching it without needing permission from the developer, and thereby making the software stronger than it was before. Open-source software communities act like a Neighborhood Watch for each other’s data, which realistically never leaves the local computer on which it’s being handled.

By contrast, a closed-source piece of software is a black box. If it contains a mistake in how it handles sensitive data, or if there’s a little block of code in there that sends an un-encrypted copy of everything you type to an insecure server in the Bahamas, there is no way for users to know about it until after there is a significant breach. In the first example, it’s typically the community that pre-emptively audits code and makes the product safer; in the second example, it’s more likely to be a malicious actor that discovers a vulnerability by poking around and exploits that vulnerability before anyone else—including the company—knows it’s there.

So which one of these to trust more? Personally, I trust my sensitive data more with a developer who can say “look for yourself, nothing up my sleeves” than with a monolithic corporation whose entire security team could be a single 20-year-old dropout with a ChatGPT subscription, that requires me to pay them a monthly fee to even use their product, that saves all my data to their own servers in the cloud, and whose company security policy basically comes down to “trust us.”

The second misunderstanding that I hear most often is that using open-source software somehow opens you up to a greater risk of malware or spyware. My first reaction is that any operating system that monitors your online activity to offer up local news/weather information or worse, to advertise to you (i.e. Windows) is spyware. Wait until you hear about how their shiny new “agentic” AI works by taking a literal screenshot of your desktop every second and uploading it to their cloud. But I also think this fear comes from a general superstition about the internet that is amplified and leveraged by closed-source software companies like antivirus developers. Companies like Microsoft and Apple have tried to build walled gardens around their OSes by steering users toward only downloading from proprietary app stores, but this is more a mechanism of value capture than of security.

Regarding malware, a little bit of common sense goes a long way. It helps to understand that the modern centralized repositories for open-source computing—e.g. Github or FOSShub—have been around for a long time now, are highly collectivized, and are self-incentivized to be safe computational spaces, otherwise no one would use them. Just like Apple’s App Store, they feature things like rating systems, comments sections, and reviews that can help determine if a piece of software does what it claims to do. Keep in mind also that the overwhelming majority of modern “hacks” are social engineering exploits—i.e. phishing emails, scam calls, fake invoices—and not software per se.

In fact the most difficult thing about getting started with FOSS is the learning curve. Developers tend to assume a high level of base knowledge, and sometimes technical resources like documentation are sparse. “Customer service” is non-existent since there are no customers, only users. But tutorials abound on places like YouTube and Reddit, and certain topics, like personal media storage, are highly popular and well-documented.

This is perhaps the most important argument to make and the most difficult to do so succinctly. In the sub-lede of this article, though I purported the separation of technology from ideology, my own biases and political perspectives will unavoidably appear here. I put off writing this essay for a long time, in part because though I work extensively with open-source software at home and in my job as a radio engineer, I’m not a coder, a developer, or even the most knowledgeable person in the room when it comes to computing.

But I believe that a computer and the software that runs on it are tools, and I believe that tools are fundamentally free from ideological bias. A hammer (or a sickle, if you prefer) does not know whether it’s being wielded by a communist or a capitalist, and it has no opinion about what it’s being used to build. A hammer can build a house or destroy one. A tool’s utility can be defined by the ability and intention of the person using it.

A software tool is the same way. The very same FFmpeg that allows something like YouTube to serve content to you can also be used trivially and for free to copy and download (i.e. “steal”) that content.

But the people manufacturing our digital tools are not ideologically neutral. I’ve already written about the Spotify CEO’s penchant for capturing value that would have traditionally gone to artists and re-investing that capital in autonomous weapons. If you disagree with the idea of autonomous weapons or at the very least with that investment strategy, it’s obvious to me that you should stop giving his company your money, full stop. The same goes for the owners of products like Instagram, YouTube, or ChatGPT who have boldly and publicly aligned with the Trump regime and its priorities. They contribute their propriety tools to projects of mass surveillance, incarceration and/or deportation without due process, prosecution of Constitutionally protected protestors as “domestic terrorists,” unjust war, and so on, all in the interest of their own profits. These companies do not think twice about handing over your user data to a corrupt justice system, if/when the subpoena comes. That satirical death threat that you penned using Google Docs? It belongs to them, not you, and the authorities don’t think it’s as funny as your friends did. If you disagree with any of these ideas, well, perhaps it’s time to stop using their tools and, more importantly, put in the hard work to understand the available alternatives.

There is a historical precedent for the wedding of technology and authoritarianism. The founder of Italian Futurism, Filippo Marinetti, evolved his artistic ideas about speed, machinery, and industry over a ten-year period that culminated in his co-writing the Fascist Manifesto in 1919 and vocal support for Mussolini. If you’re not familiar with how that era of Italian authoritarianism ended, there is a picture or two online. The Chinese government currently uses advanced AI detection systems to monitor traffic and automatically report people for minor infractions (as well as bark at them through speakers on the cameras). We are grappling with a similar phenomenon—only privatized—with the non-consensual arrival of over a hundred thousand Flock Safety cameras across nearly every community. Modern American tech companies have yet to suffer any real consequences from their authoritarian alignment, but I dream that they will. Switching to open-source tools at least allows us to separate our mundane computational tasks from their willingness to participate in anti-democratic, anti-justice, and ultimately anti-human profiteering.

If you take anything away from this essay, let it be this: complicity masquerades as convenience. I get it; switching your 15 year-old email address from Google to something more privacy-oriented is a pain in the ass. But in a globally capitalist society ensnared by a handful of rent- and power-seeking profiteers, one of our few-yet-powerful collective resources is our freedom to spend our money where we decide. Even this is not guaranteed—Trump has casually blurted on the mic, as he does, that boycotting should be illegal. The problem is not necessarily his demented verbal diarrhea, but the sycophantic goblins that run to the Supreme Court with it. Keep in mind that earlier this year, over a disagreement about weaponizing the software, the Trump administration simply declared Anthropic’s AI to be a national security threat and shut it down tout de suite. What would you do if they made owning a hammer a “national security threat?”

The tech monoliths are not exactly monolithic, and we are under no obligation to use their enshittified products. Even AI seems to finally be quaking as its developers post comically massive losses quarter after quarter, major companies like Ford admit to re-hiring hundreds of previously laid-off staff, and data center construction projects come under immense public scrutiny. Most AI pundits that I keep up with seem to agree that the future of AI is not in massive private models that need drought-inducing data centers to function, but in locally run models that are—you guessed it—free & open-source.

Mostly the World Cup, to be honest.

I came to this 1988 documentary by Marcel Ophuls—son of the esteemed Max—in search of an optimistic template for a future kind of justice to-be-served. I left 4.5 hours later feeling conflicted and less hopeful.

Hôtel Terminus tells the contemporaneous story of the trial and conviction of one of the last Nazis to be extracted from South America for crimes committed during World War II. Klaus Barbie was the head of the Gestapo in Lyon, France, which used the eponymous hotel as its headquarters. He earned the nickname “the butcher of Lyon” for his ruthless penchant for torture, and it’s at last estimated that he personally consigned up to 14,000 people to concentration camps. Bad guy, right?

The film picks up in 1983 as he’s being deported back to France after being discovered in Bolivia (itself a ten-year process, since he was known to be living there under an assumed name as early as 1972). He’s old, very obviously infirm, and of course in complete denial of his violent past.

Ophuls interviews French, Germans, Americans, and Bolivians who all crossed paths with Barbie over the 40-year period since the war, and the variety of responses to his trial range from the subdued to the outrageous. Here is a French woman in her 50s, old enough to remember standing before Barbie at the hotel while he beat her family and then deported them to Auschwitz except for her. Here is an American ex-GI who hired Barbie after the war for counter-intelligence operations, either blind to his role during the war or choosing to ignore it. Here another American GI who helped secret Barbie off to Bolivia in the early ‘50s, in disbelief (or denial) that it’s his own name and signature on the declassified paperwork about Operation Ratline.

Again and again the same refrain: “It was 40 years ago, can’t we just leave it behind?” “I don’t remember, it was 40 years ago.” “He’s an old man now, and all that is 40 years in the past.” And yet here, in the flesh, are living people who might still have had a family if not for Klaus Barbie, who have waited those 40 years for justice to arrive.

The film ends with Barbie’s conviction (he later died in prison), but the final scene is with the middle-aged French woman, standing outside the apartment from which she was abducted as a child. The same person is still living in the apartment below her former family home, a place her own family might have occupied for 40 more years if they hadn’t been murdered. The homeowner, leaning out the window to ask about the film crew in the street, poorly feigns that she doesn’t remember or recognize the woman’s family name. Down on the street, the Jewish woman shakes her head and sighs to Ophuls, “she does know me, she does. I remember her.”

“One day everyone will always have been against this,” read the pithy signs and T-shirts at our own current-day protests. I don’t have a hopeful reading of that phrase. To me, it means that one day, everyone—including the people who currently support the deportations, the concentration camps, the murder of American citizens in Minneapolis and beyond—will claim to have always been against it. That includes not just corrupt politicians, judges, lawyers, and ICE officers, but CEOs and technologists that currently bend the knee. In the face of apathy, ennui, and groaning to let the past be the past, it will be up to us to insist that our society hold them accountable—all of them—whether it’s in the next four years or the next forty.