racist, misogynist, homophobic, fascist content in fortunes-off binary package

[Steve Langasek]

"I've discovered that currently, as of Ubuntu 22.10, Ubuntu distributes a package called "fortunes-off" that is full of homophobia, Hitler quotes, virulent misogyny, racism, and more, for the "fortunes" program"

https://mastodon.social/@<email address hidden>/109349931159589086

This kind of content is not consistent with Ubuntu values and should not be distributed as part of Ubuntu, regardless of whether it is hidden by a content warning and made opt-in. Like many packages in the Ubuntu archive, this package is synced, unreviewed, from Debian; except for some formatting changes, typo fixes, and *additions* to the "offensive" database (of fortunes moved there from the "inoffensive" database), these files have remained unchanged since the origin of Ubuntu (first import of fortune-mod was version 9708-36, uploaded to Debian in January 2004). It is unclear if anyone has ever reviewed this content on behalf of Debian to determine if it's appropriate to distribute, but I'm confident in saying no one ever did so on behalf of Ubuntu and made a determination that this content is OK.

No one maintains fortunes-mod in Ubuntu - it's safe to say no one does in Debian either, as the last maintainer upload was in 2013 - and I am not interested in reading through this garbage to determine which of the "offensive" entries fall just shy of some invisible line to be worthy of continued inclusion.

I have reviewed the contents of the database sufficiently to establish the truth of the above charge and will spend no further time parsing it.

Effective immediately I am removing the fortunes-off binary package from fortune-mod in Ubuntu.

If someone wants to make the case that some of this content is worthy of continued distribution, let them bear the burden of demonstrating that it is, on a case-by-case basis, appropriate to do so.

[Arminius Silvanus (arminius-silvanus)]

A cursory search shows that there are also packages fortunes-it-off and fortunes-es-off containing offensive fortunes in Italian and Spanish, respectively. Could you look into removing these packages as well?

[Steve Langasek (vorlon)]

The fact that they have been categorized as "offensive" does not per se mean they are unfit for inclusion, since "offensive" means many things to many people. Have you looked at the contents of these packages and found them to have the same problem as in the bug title? (If not, I will look at them myself - just wondering if you've done the work already and can save me the effort)

[Steve Langasek (vorlon)]

confirmed that this affects fortunes-es also.

[Steve Langasek (vorlon)]

I have skimmed fortunes-it (testi/*-o) and while I find the value of many of these fortunes questionable, I was not able to identify any that fall afoul of the criteria in the bug title. There are lots of things marked offensive due to references to / descriptions of sex, which is not one of the criteria above. This package certainly does not, as the others do, have input files categorized by the type of offense including misogyny and racism. If someone identifies specific content that is a problem, we can revisit. However, given the much smaller corpus, this one might be better dealt with by filing bugs in Debian and working with the maintainer to get them removed.

[Wolf Weidner (wolf-weidner)]

try:
!/usr/games/fortune -o -m '###'
!/usr/games/fortune -o -m Hitler

The distribution of these contents are very likely a criminal offense in Germany and Austria.

[Steve Langasek (vorlon)]

On Wed, Nov 16, 2022 at 04:55:36PM -0000, Wolf Weidner wrote:
> try:
> !/usr/games/fortune -o -m '###'
> !/usr/games/fortune -o -m Hitler

If you have a concrete instance of a fortune that you believe violates
Ubuntu's Code of Conduct and should be removed, please provide a direct
reference. The above commands are not a helpful suggestion. Marge
Simpson's hairdo in ascii art is not a violation.

> The distribution of these contents are very likely a criminal offense in
> Germany and Austria.

[Citation needed] because referencing Adolf Hitler's name isn't it.

[Wolf Weidner (wolf-weidner)]

The lines are helpful if you run them after installing the package in question.

-o selects only offensive
-m matches a string

> !/usr/games/fortune -o -m '###'
Will give you an ASCII art swastika.(see linked mastodon post above) Which is illegal to distribute for entertainment in Germany and Austria.

> !/usr/games/fortune -o -m Hitler
Will give you various Quotes of Hitler that qualify as illegal NS propaganda.

e.g.
"
"I believe today that I am acting in the sense of the Almighty Creator.
 By warding off the Jews I am fighting for the Lord's work."
           [Adolph Hitler, Speech, Reichstag, 1936]
"

[Steve Langasek (vorlon)]

On Wed, Nov 16, 2022 at 05:44:31PM -0000, Wolf Weidner wrote:
> The lines are helpful if you run them after installing the package in
> question.

> -o selects only offensive
> -m matches a string

> > !/usr/games/fortune -o -m '###'
> Will give you an ASCII art swastika.(see linked mastodon post above) Which is illegal to distribute for entertainment in Germany and Austria.

In the fortunes-off package which is being removed. Again, not helpful.
The only open question was about fortunes-*it*-off.

[Arminius Silvanus (arminius-silvanus)]

Thank you for taking the time and effort to look into these packages. I have not actually looked into the packages myself, no. I merely noticed that they existed and wanted to point them out so that they're not glossed over because they're different packages.

[Launchpad Janitor (janitor)]

This bug was fixed in the package fortunes-es - 1.36ubuntu1

---------------
fortunes-es (1.36ubuntu1) lunar; urgency=medium

  * Stop building the fortunes-es-off binary package. The contents are
    inconsistent with Ubuntu values, and making them "opt-in" does not
    change this. LP: #1996682.
  * Fix debian/rules to stop double shipping of the offensive fortunes files
    in the fortunes-es binary package.

 -- Steve Langasek <email address hidden> Wed, 16 Nov 2022 16:32:20 +0000

[Wolf Weidner (wolf-weidner)]

>The only open question was about fortunes-*it*-off.
I am using launchpads web interface. There was no inidication that you were asking about the Italian version. Glad to see the issue resolved.

[Jeremy Chadwick (koitsu)]

Those participating in this removal should be very careful in their endeavours. Rewriting or erasing history is not necessarily the best choice for *everyone*, as offence is highly subjective.

NetBSD and FreeBSD both went through this situation (with fortune and fortune offensives) circa 2017. I urge participants to read these histories -- especially every single reply/thread on the NetBSD list -- as there is contextual relevancy and histories worth considering (honest!). You can find relevant details/links here: https://github.com/koitsu/fortune-mod-freebsd-classic#history

I will not be responding to this ticket past this point, given the volatile nature of the subject. I only ask participants think long and hard about the decision, regardless what is chosen.

[Jijo (jijowi)]

The fortunes-offensive package being offensive is intended behaviour and does not need fixing. If you would like to not be offended, please either don't install the package, or run with the -o (the o stands for offensive) argument.

CLOSED WONTFIX

P.S: This is not a high importance issue, so please don't flag it as such. Those are delegated to things that actually matter like security vulnerabilities/exploits, hardware incompatibilities, performance issues, etc.

[Gareth Hart (tghe-retford)]

This bug and its fix is incompatible with the philosophy of free and open source software. The right way to deal with this issue is to fork the package and remove the cookies in issue, not apply this change to everyone or require everyone else to create their own fork.

If we go down this route, how long before Network MANager gets pulled up for having a politically incorrect name that is misogynistic and will cause offence?

[Steve Langasek (vorlon)]

The source package which removes this binary has not yet migrated from lunar-proposed because the autopkgtest queues have quite a backlog from the release opening and initial Debian sync, but I've gone ahead and removed the fortunes-off binary from the lunar release pocket which would have happened soon anyway:

Removing packages from lunar:
 fortunes-off 1:1.99.1-7.1 in lunar amd64
 fortunes-off 1:1.99.1-7.1 in lunar arm64
 fortunes-off 1:1.99.1-7.1 in lunar armhf
 fortunes-off 1:1.99.1-7.1 in lunar i386
 fortunes-off 1:1.99.1-7.1 in lunar ppc64el
 fortunes-off 1:1.99.1-7.1 in lunar riscv64
 fortunes-off 1:1.99.1-7.1 in lunar s390x
Comment: NBS
7 packages successfully removed.

I'm therefore marking this bug fix released, and unsubscribing. All you randos piling on to argue that you have a right to receive racist, homophobic, misogynistic, and fascist content via Ubuntu, have at. No one's listening.

[Hans Sauerkraut (hans-sauerkraut)]

The fix (i.e., not building the "binary" package from the sources) is
not enough. We need to get rid of the offensive content (at least the
Nazi symbols and quotes) in the source package as well, preferably by
means of upstream removing it. Saying "if you don't want to be
offended, don't install that package" is too short-sighted.

We need to worry about the mirrors!

I am not a lawyer, but in my understanding, at least in Germany and
Austria, redistributing Nazi symbols and Hitler quotes for entertainment
(we are not talking about a wikipedia article that gives a comprehensive
overview and deals critically with this topic) might well be a criminal
offense. An even if it was technically legal - if the dean of a German
public university gets aware of this thread here, I see a significant
risk that (s)he will have the IT department pull the plug, as spending
taxpayer's money for mirroring this kind of content cannot be justified,
even if these few bytes are negligible in the overall budget. And this
might set off a chain reaction, with more ftp mirrors going offline,
maybe beyond the borders of these two countries.

Germany and Austria are significant parts of the open source community.
About half of the Ubuntu mirrors in Germany listed at
https://launchpad.net/ubuntu/+archivemirrors seem to be run by
organizations funded by the taxpayer. There is much at stake, for a
package that adds little to no value to Linux, except for the fact that
it has been around for decades. Please remove that content completely.

[cm-t 🦄🏂🌈🎵 (cm-t)]

It seems this bug not only affects/affected those package, but also, the comment section.
I don't see any "report a comment" button (...)