4 ms·

You raise a good point, which prompts a genuine question: does having a free OS and BIOS help safeguard against "rogue" peripherals (since the system knows what

You raise a good point, which prompts a genuine question: does having a free OS and BIOS help safeguard against "rogue" peripherals (since the system knows what they're supposed to do)?

eropple 10y ago
The system doesn't, though, not really. I mean, consider something running over Thunderbolt. A device that doesn't even tell you it supports Thunderbolt (and triggers it via USB3 alternate modes) then has direct, unimpeded access to the physical memory space of the computer. PCMCIA cards, PCI cards, FireWire...USB, itself is more intermediated--but that's also why latency is higher. You can disable DMA in the BIOS, but then lots of devices won't work at all. If you're doing free-all-the-stuff for principle, I think it gets un-comfy drawing the line at stuff that runs on x86 and ARM ('specially as your monitor probably has an ARM in it anyway). If you're doing it for security, I think you must strive for peripheral openness too, or you're mostly wasting your time.
- ralmidani 10y ago
  Thanks for your insights. I believe computing freedom is a right people should assert, and I should inform them why they should assert it, but I don't go as far as saying it's unethical to use non-free devices and/or software. At least not when non-free is more readily available and, from the perspective of the average user, more "convenient" than free. Personally, I like Debian because it removes non-free blobs from the kernel (and I check the license on a package before I install it). But let's say Ubuntu was the only available GNU+Linux distribution. I would still choose it over Windows or MacOS because mostly free is better than completely non-free, and I would rather support Ubuntu (or Android, for that matter) than enable and give money to Microsoft or Apple. As for peripherals, from a practical point of view, doesn't the type of peripheral matter? A monitor or printer (output devices) going rogue seem far less dangerous than a rogue webcam, for example.
  - eropple 10y ago
    If the monitor speaks Thunderbolt, then it can DMA your system memory and going rogue is a game-over situation. Personally, I don't really care at all about RMS's weird definition of freedom and I use what's best for accomplishing my goals. But drawing arbitrary lines of "freedom" has always made even less sense to me.
- imtringued 10y ago
  >A device that doesn't even tell you it supports Thunderbolt Thunderbolt devices have to be approved before they can be used. http://dxg49ziwjgkgt.cloudfront.net/wp-content/uploads/2016/05/auth0-520x191.png http://dxg49ziwjgkgt.cloudfront.net/wp-content/uploads/2016/... http://dxg49ziwjgkgt.cloudfront.net/wp-content/uploads/2016/05/auth2-520x265.png http://dxg49ziwjgkgt.cloudfront.net/wp-content/uploads/2016/...
  - eropple 10y ago
    They don't have to; some operating systems allow you to make that call. And they can lie to you, so that approval means very little.

You raise a good point, which prompts a genuine question: does having a free OS and BIOS help safeguard against "rogue" peripherals (since the system knows what they're supposed to do)?

eropple 10y ago

The system doesn't, though, not really. I mean, consider something running over Thunderbolt. A device that doesn't even tell you it supports Thunderbolt (and triggers it via USB3 alternate modes) then has direct, unimpeded access to the physical memory space of the computer. PCMCIA cards, PCI cards, FireWire...USB, itself is more intermediated--but that's also why latency is higher. You can disable DMA in the BIOS, but then lots of devices won't work at all. If you're doing free-all-the-stuff for principle, I think it gets un-comfy drawing the line at stuff that runs on x86 and ARM ('specially as your monitor probably has an ARM in it anyway). If you're doing it for security, I think you must strive for peripheral openness too, or you're mostly wasting your time.

ralmidani 10y ago
Thanks for your insights. I believe computing freedom is a right people should assert, and I should inform them why they should assert it, but I don't go as far as saying it's unethical to use non-free devices and/or software. At least not when non-free is more readily available and, from the perspective of the average user, more "convenient" than free. Personally, I like Debian because it removes non-free blobs from the kernel (and I check the license on a package before I install it). But let's say Ubuntu was the only available GNU+Linux distribution. I would still choose it over Windows or MacOS because mostly free is better than completely non-free, and I would rather support Ubuntu (or Android, for that matter) than enable and give money to Microsoft or Apple. As for peripherals, from a practical point of view, doesn't the type of peripheral matter? A monitor or printer (output devices) going rogue seem far less dangerous than a rogue webcam, for example.
- eropple 10y ago
  If the monitor speaks Thunderbolt, then it can DMA your system memory and going rogue is a game-over situation. Personally, I don't really care at all about RMS's weird definition of freedom and I use what's best for accomplishing my goals. But drawing arbitrary lines of "freedom" has always made even less sense to me.
imtringued 10y ago
>A device that doesn't even tell you it supports Thunderbolt Thunderbolt devices have to be approved before they can be used. http://dxg49ziwjgkgt.cloudfront.net/wp-content/uploads/2016/05/auth0-520x191.png http://dxg49ziwjgkgt.cloudfront.net/wp-content/uploads/2016/... http://dxg49ziwjgkgt.cloudfront.net/wp-content/uploads/2016/05/auth2-520x265.png http://dxg49ziwjgkgt.cloudfront.net/wp-content/uploads/2016/...
- eropple 10y ago
  They don't have to; some operating systems allow you to make that call. And they can lie to you, so that approval means very little.