6 ms·

Ah crap, why ruin something great just out of greed (What other reason could there be?) :-(

danjoc 10y ago
Could you elaborate on how this ruins the yubikey 4? As a security measure, the software on the YK4 cannot be updated. Therefore, the software in question could have essentially been implemented as hardware. It is hardwired and will never change. I can't find the reference, but since there's no software update functionality, I'm under the impression even Richard Stallman would be okay with it under these circumstances. Edit: Found it. https://stallman.org/stallman-computing.html https://stallman.org/stallman-computing.html "As for microwave ovens and other appliances, if updating software is not a normal part of use of the device, then it is not a computer. In that case, I think the user need not take cognizance of whether the device contains a processor and software, or is built some other way. However, if it has an "update firmware" button, that means installing different software is a normal part of use, so it is a computer." Straight from the big GNU's mouth.
- mpeg 10y ago
  I'm pretty certain RMS would advocate for both the hardware and the software being open.
  - davorb 10y ago
    Here's his stance on the issue. > there is no need to reject hardware with nonfree designs on principle. http://www.wired.com/2015/03/need-free-digital-hardware-designs/ http://www.wired.com/2015/03/need-free-digital-hardware-desi...
    - tadfisher 10y ago
      Because he founded the Free Software Foundation, not the Free Products Foundation. At some point, you have to define the term "software" in order to focus your mission, and given the Four Freedoms that underpin the notion of Free Software, the current definition is apt. That's not to say that there isn't value in open hardware, and certainly it's not a bad idea to advocate for open designs. It's just not part of the FSF's mission.
- colemickens 10y ago
  And if the security of your infrastructure lied with the operations of that microwave, I'm pretty sure he'd advocate for it being open hardware as well.
- kerkeslager 10y ago
  I won't comment on what Stallman might think about the Yubikey, but for my goals, a closed-source Yubikey is useless, because it's security can't be verified. You don't even have to believe in GNU Philosophy to prefer verifiable security to unverifiable security.
  - oconnore 10y ago
    Were you going to put the microprocessor under an electron microscope? No? Then nothing has changed. I also think open hardware would be pretty neat, but software people who get really upset about layers they can't verify implemented on top of layers they can't verify sound pretty silly. Either you verify from the bottom or you can't verify at all.
    - tadfisher 10y ago
      This is a common response but it's not addressing the core issue. Bugs and vulnerabilities are discovered every day in the layers that can be independently verified. Your argument extends to every single piece of software everywhere that runs on Intel and AMD microprocessors, for instance. It's foolish to say that an OpenSSL instance shouldn't be examined because the network interface it communicates over uses a proprietary firmware blob, or runs on Windows, for instance. I agree that the freedom to verify the behavior of (what amounts to) firmware is not one of the Four Freedoms, but there is a non-zero value in being able to find bugs and help the manufacturer improve the product, as well as being able to use that information to inform a purchasing decision. Especially for something which could potentially be considered to provide organizational security.
      - oconnore 10y ago
        My point is not that you shouldn't verify OpenSSL code. My point is that you shouldn't pretend that you don't implicitly trust Intel/AMD (or Yubikey).
        mort96 10y ago
- RRRA 10y ago
  Then again Stallman's view about hardware (and closed appliance) has always been in relation to how easy it is for someone to actually make one on their own... So it might not be that simple.
jonny_eh 10y ago
But why would greed lead to this? Why make this change at all?
- deckar01 10y ago
  Maybe trying to net a large an enterprise customer? Do they have any public partnerships that are anti-open source? Edit: They seem to have a pretty even mix of open source a closed source enterprise partnerships. https://www.yubico.com/support/partners/ https://www.yubico.com/support/partners/
  - cbhl 10y ago
    That seems pretty backwards. In my opinion, an enterprise, at a minimum, should be asking for source code escrow, if not outright source code access (either FOSS or under NDA).
- MichaelGG 10y ago
  The linked GitHub issue mentions this: The new platform is a different system and doesn't run Java so it's not using the old code that was open. They found no reason to publish the new code as it doesn't help anyone since it's integrated into the rest of their platform. And it sounds like you can't update the code. So you don't have a way of verifying what the actual device runs. So people complaining about trust here are somewhat misguided when they say they don't want to trust Yubi. Open sourcing would only help find non malicious bugs. Since it sounds non modular there's possibly all sorts of stuff mixed in making it hard to audit so they decided it wasn't worth it. Dunno if that's right but that's what it sounds like.
  - Freak_NL 10y ago
    Strange. Yubico's dainnilsson is usually quite forthcoming with responses to questions, but his final response in that GitHub thread worries me (he seems harrowed). I am genuinely curious what reason there could be not to open-source the code. I am not expecting any trade secrets in there; any competitor's biggest challenge by far is getting the hardware right and getting an assembly line going. On the other hand, keeping the code closed does garner a lot of distrust.
vox_mollis 10y ago
What other reason could there be? There is one, big, obvious government-shaped reason.
- xyience 10y ago
  Come on HN, this comment was answering the parent directly. Unless you've been under a rock for the last 4 years there's no excuse to downvote even if you think it's still low-probability...
  - api 10y ago
    There's still this meme out there that anyone who thinks the government might be doing something nefarious is a "conspiracy theorist." People around here tend to want to be upper-class educated no-nonsense rational types of people, which means you can't be entertaining woo-woo conspiracy theories. I think this is a lazy broken heuristic that ends up labeling all social criticism and all allegations (even if credible) as "crazy." It's very Soviet-- you are mentally ill if you disagree with the government. The problem is that we have hard documentation that governments (including but not limited to the USA) have run actual named and funded programs and efforts with the explicit intent of sabotaging crypto available in the public market. It's not even a "theory." It's established historical fact. Believing the queen of England is a shape shifting reptile or that we didn't go to the Moon is a woo-woo conspiracy theory. Believing in things with a hard paper trail is not, nor is entertaining the possibility that governments might be doing things that we know for a fact they have done in the past.
    - pdkl95 10y ago
      > It's very Soviet It's not only a Soviet phenomena; American politics has utilized a "paranoid style"[1] for a long time. > sabotaging crypto It seems like a lot of people are pretending that BULLRUN doesn't exist. Nobody wants to believe that a coworker might be a collaborator; that kind of thinking can easily erode trust and create paranoia even when it isn't warranted. Unfortunately, the program exists so it's foolish to ignore the probability that it is still working to weaken crypto. As PHK explain in "Operation Orchestra", encouraging weak crypto is much cheaper than breaking real crypto. [1] https://en.wikipedia.org/wiki/The_Paranoid_Style_in_American_Politics https://en.wikipedia.org/wiki/The_Paranoid_Style_in_American...

Could you elaborate on how this ruins the yubikey 4? As a security measure, the software on the YK4 cannot be updated. Therefore, the software in question could have essentially been implemented as hardware. It is hardwired and will never change. I can't find the reference, but since there's no software update functionality, I'm under the impression even Richard Stallman would be okay with it under these circumstances. Edit: Found it. https://stallman.org/stallman-computing.html https://stallman.org/stallman-computing.html "As for microwave ovens and other appliances, if updating software is not a normal part of use of the device, then it is not a computer. In that case, I think the user need not take cognizance of whether the device contains a processor and software, or is built some other way. However, if it has an "update firmware" button, that means installing different software is a normal part of use, so it is a computer." Straight from the big GNU's mouth.

mpeg 10y ago
I'm pretty certain RMS would advocate for both the hardware and the software being open.
- davorb 10y ago
  Here's his stance on the issue. > there is no need to reject hardware with nonfree designs on principle. http://www.wired.com/2015/03/need-free-digital-hardware-designs/ http://www.wired.com/2015/03/need-free-digital-hardware-desi...
  - tadfisher 10y ago
    Because he founded the Free Software Foundation, not the Free Products Foundation. At some point, you have to define the term "software" in order to focus your mission, and given the Four Freedoms that underpin the notion of Free Software, the current definition is apt. That's not to say that there isn't value in open hardware, and certainly it's not a bad idea to advocate for open designs. It's just not part of the FSF's mission.
colemickens 10y ago
And if the security of your infrastructure lied with the operations of that microwave, I'm pretty sure he'd advocate for it being open hardware as well.
kerkeslager 10y ago
I won't comment on what Stallman might think about the Yubikey, but for my goals, a closed-source Yubikey is useless, because it's security can't be verified. You don't even have to believe in GNU Philosophy to prefer verifiable security to unverifiable security.
- oconnore 10y ago
  Were you going to put the microprocessor under an electron microscope? No? Then nothing has changed. I also think open hardware would be pretty neat, but software people who get really upset about layers they can't verify implemented on top of layers they can't verify sound pretty silly. Either you verify from the bottom or you can't verify at all.
  - tadfisher 10y ago
    This is a common response but it's not addressing the core issue. Bugs and vulnerabilities are discovered every day in the layers that can be independently verified. Your argument extends to every single piece of software everywhere that runs on Intel and AMD microprocessors, for instance. It's foolish to say that an OpenSSL instance shouldn't be examined because the network interface it communicates over uses a proprietary firmware blob, or runs on Windows, for instance. I agree that the freedom to verify the behavior of (what amounts to) firmware is not one of the Four Freedoms, but there is a non-zero value in being able to find bugs and help the manufacturer improve the product, as well as being able to use that information to inform a purchasing decision. Especially for something which could potentially be considered to provide organizational security.
    - oconnore 10y ago
      My point is not that you shouldn't verify OpenSSL code. My point is that you shouldn't pretend that you don't implicitly trust Intel/AMD (or Yubikey).
      - mort96 10y ago
RRRA 10y ago
Then again Stallman's view about hardware (and closed appliance) has always been in relation to how easy it is for someone to actually make one on their own... So it might not be that simple.

jonny_eh 10y ago

But why would greed lead to this? Why make this change at all?

deckar01 10y ago
Maybe trying to net a large an enterprise customer? Do they have any public partnerships that are anti-open source? Edit: They seem to have a pretty even mix of open source a closed source enterprise partnerships. https://www.yubico.com/support/partners/ https://www.yubico.com/support/partners/
- cbhl 10y ago
  That seems pretty backwards. In my opinion, an enterprise, at a minimum, should be asking for source code escrow, if not outright source code access (either FOSS or under NDA).
MichaelGG 10y ago
The linked GitHub issue mentions this: The new platform is a different system and doesn't run Java so it's not using the old code that was open. They found no reason to publish the new code as it doesn't help anyone since it's integrated into the rest of their platform. And it sounds like you can't update the code. So you don't have a way of verifying what the actual device runs. So people complaining about trust here are somewhat misguided when they say they don't want to trust Yubi. Open sourcing would only help find non malicious bugs. Since it sounds non modular there's possibly all sorts of stuff mixed in making it hard to audit so they decided it wasn't worth it. Dunno if that's right but that's what it sounds like.
- Freak_NL 10y ago
  Strange. Yubico's dainnilsson is usually quite forthcoming with responses to questions, but his final response in that GitHub thread worries me (he seems harrowed). I am genuinely curious what reason there could be not to open-source the code. I am not expecting any trade secrets in there; any competitor's biggest challenge by far is getting the hardware right and getting an assembly line going. On the other hand, keeping the code closed does garner a lot of distrust.

vox_mollis 10y ago

What other reason could there be? There is one, big, obvious government-shaped reason.

xyience 10y ago
Come on HN, this comment was answering the parent directly. Unless you've been under a rock for the last 4 years there's no excuse to downvote even if you think it's still low-probability...
- api 10y ago
  There's still this meme out there that anyone who thinks the government might be doing something nefarious is a "conspiracy theorist." People around here tend to want to be upper-class educated no-nonsense rational types of people, which means you can't be entertaining woo-woo conspiracy theories. I think this is a lazy broken heuristic that ends up labeling all social criticism and all allegations (even if credible) as "crazy." It's very Soviet-- you are mentally ill if you disagree with the government. The problem is that we have hard documentation that governments (including but not limited to the USA) have run actual named and funded programs and efforts with the explicit intent of sabotaging crypto available in the public market. It's not even a "theory." It's established historical fact. Believing the queen of England is a shape shifting reptile or that we didn't go to the Moon is a woo-woo conspiracy theory. Believing in things with a hard paper trail is not, nor is entertaining the possibility that governments might be doing things that we know for a fact they have done in the past.
  - pdkl95 10y ago
    > It's very Soviet It's not only a Soviet phenomena; American politics has utilized a "paranoid style"[1] for a long time. > sabotaging crypto It seems like a lot of people are pretending that BULLRUN doesn't exist. Nobody wants to believe that a coworker might be a collaborator; that kind of thinking can easily erode trust and create paranoia even when it isn't warranted. Unfortunately, the program exists so it's foolish to ignore the probability that it is still working to weaken crypto. As PHK explain in "Operation Orchestra", encouraging weak crypto is much cheaper than breaking real crypto. [1] https://en.wikipedia.org/wiki/The_Paranoid_Style_in_American_Politics https://en.wikipedia.org/wiki/The_Paranoid_Style_in_American...