5 ms·
Could you elaborate on how this ruins the yubikey 4? As a security measure, the software on the YK4 cannot be updated. Therefore, the software in question could
by danjoc 10y ago
Could you elaborate on how this ruins the yubikey 4? As a security measure, the software on the YK4 cannot be updated. Therefore, the software in question could have essentially been implemented as hardware. It is hardwired and will never change. I can't find the reference, but since there's no software update functionality, I'm under the impression even Richard Stallman would be okay with it under these circumstances.
Edit: Found it. https://stallman.org/stallman-computing.html https://stallman.org/stallman-computing.html
"As for microwave ovens and other appliances, if updating software is not a normal part of use of the device, then it is not a computer. In that case, I think the user need not take cognizance of whether the device contains a processor and software, or is built some other way. However, if it has an "update firmware" button, that means installing different software is a normal part of use, so it is a computer."
Straight from the big GNU's mouth.
- mpeg 10y agoI'm pretty certain RMS would advocate for both the hardware and the software being open.
- davorb 10y agoHere's his stance on the issue. > there is no need to reject hardware with nonfree designs on principle. http://www.wired.com/2015/03/need-free-digital-hardware-designs/ http://www.wired.com/2015/03/need-free-digital-hardware-desi...
- tadfisher 10y agoBecause he founded the Free Software Foundation, not the Free Products Foundation. At some point, you have to define the term "software" in order to focus your mission, and given the Four Freedoms that underpin the notion of Free Software, the current definition is apt. That's not to say that there isn't value in open hardware, and certainly it's not a bad idea to advocate for open designs. It's just not part of the FSF's mission.
- colemickens 10y agoAnd if the security of your infrastructure lied with the operations of that microwave, I'm pretty sure he'd advocate for it being open hardware as well.
- kerkeslager 10y agoI won't comment on what Stallman might think about the Yubikey, but for my goals, a closed-source Yubikey is useless, because it's security can't be verified. You don't even have to believe in GNU Philosophy to prefer verifiable security to unverifiable security.
- oconnore 10y agoWere you going to put the microprocessor under an electron microscope? No? Then nothing has changed. I also think open hardware would be pretty neat, but software people who get really upset about layers they can't verify implemented on top of layers they can't verify sound pretty silly. Either you verify from the bottom or you can't verify at all.
- tadfisher 10y agoThis is a common response but it's not addressing the core issue. Bugs and vulnerabilities are discovered every day in the layers that can be independently verified. Your argument extends to every single piece of software everywhere that runs on Intel and AMD microprocessors, for instance. It's foolish to say that an OpenSSL instance shouldn't be examined because the network interface it communicates over uses a proprietary firmware blob, or runs on Windows, for instance. I agree that the freedom to verify the behavior of (what amounts to) firmware is not one of the Four Freedoms, but there is a non-zero value in being able to find bugs and help the manufacturer improve the product, as well as being able to use that information to inform a purchasing decision. Especially for something which could potentially be considered to provide organizational security.
- RRRA 10y agoThen again Stallman's view about hardware (and closed appliance) has always been in relation to how easy it is for someone to actually make one on their own... So it might not be that simple.