3 ms·

Anybody knows why vendors are still afraid of releasing their firmwares as source code? I mean are they afraid of patent law suits or do they hope they can cove

by JepZ 9y ago

Anybody knows why vendors are still afraid of releasing their firmwares as source code? I mean are they afraid of patent law suits or do they hope they can cover up some super secrect sauce within their products? At the moment I feel like closed source firmwares are one of the biggest issues for open source operating systems (especially with regard to mobile operating systems).

Juliate 9y ago
Open-sourcing process (that is not part of the culture/structure of manufacturers) and consequences (that provide no direct benefit on the manufacturer industrial bottom line). Consider: * direct IP & IP on sub-systems, * possibility to reverse firmware-added tweaks (used to make/justify market segmentation). From the commons point of view, we'd all benefit from open source firmwares. From each and every one manufacturer POV, the associated risk and cost look way bigger than the hypothetical business benefit.
svendbt 9y ago
A few points from my own experience: - Competitive advantage. Providing open source drivers/stacks will in many cases provide insight into implementation details you do not want competitors to easily understand. Also, complex software stacks (the generic parts) could be recompiled by a competitor into a "free" stack of their own. Closed source provides a barrier for competitors to entering the market by cheating/stealing. In addition, all silicon have bugs that you don't always want your competitors to know about by seeing the workarounds in SW. They will use that against you when trying to replace your chip in a product. - Customer support and liability With limited customer support resources, you don't want to debug your product for a customer without knowing exactly what code is running. This applies both for the end product and the silicon vendor. As an example - what happens if a modified driver bricks the product?
- mikegerwitz 9y ago
  > Providing open source drivers/stacks will in many cases provide insight into implementation details you do not want competitors to easily understand Competitors will have the resources to reverse engineer; it's not an effective means of hiding implementation details. It _is_ an effective means of wasting free software and security communities' time by forcing them to reverse engineer if they want to use hardware.
  - svendbt 9y ago
    They will, but the cost to do so increases by several decades.
brudgers 9y ago
Assuming that the vendors act as they do out of fear biases causal analysis away from simple business cases. One of those cases is that vendors may have developed their firmware with software that limits the ways the firmware can be distributed. Another case is that vendors may have incorporated software licensed from other companies and that license agreement prevents release of the source code...or more simply the third party software may have been distributed as a binary. Finally, the source code may have been developed with custom or proprietary tooling, build systems, etc. that are not generally available and so releasing the source code doesn't mean that people can use it or understand it. Theoretically, it is possible to untangle a big ball of string. Theoretically, it is not possible to untangle a big ball of mud.
- Anticapitalist 9y ago
  You missed the most likely business case. The hardware across a family with different prices and features is identical. Features are then enabled/disabled by firmware alone. This is frequently done to save on silicon manufacturing costs, but still allows marketing/sales to negotiate on features.
  - brudgers 9y ago
    Thanks for pointing out the additional use case that can receive more consideration once fear is removed as a primary motivation. I think that order to be a primary motivating behavior, it would have to also be the case that none of the licensing/tooling issues apply. This suggests that logically it may be less likely as a primary cause due to the dependency.
  - JepZ 9y ago
    Well, yeah that is a problem. Does anybody here have an idea how that could be solved? I mean if the firmware would be released with its source everybody could buy the cheap version and load the full-featured firmware version to their hardware. Even if the manufacturer would place some kind of memory on the hardware which holds the feature-level, someone could patch the firmware to ignore that value.

by JepZ 9y ago

Juliate 9y ago

Open-sourcing process (that is not part of the culture/structure of manufacturers) and consequences (that provide no direct benefit on the manufacturer industrial bottom line). Consider: * direct IP & IP on sub-systems, * possibility to reverse firmware-added tweaks (used to make/justify market segmentation). From the commons point of view, we'd all benefit from open source firmwares. From each and every one manufacturer POV, the associated risk and cost look way bigger than the hypothetical business benefit.

svendbt 9y ago

A few points from my own experience: - Competitive advantage. Providing open source drivers/stacks will in many cases provide insight into implementation details you do not want competitors to easily understand. Also, complex software stacks (the generic parts) could be recompiled by a competitor into a "free" stack of their own. Closed source provides a barrier for competitors to entering the market by cheating/stealing. In addition, all silicon have bugs that you don't always want your competitors to know about by seeing the workarounds in SW. They will use that against you when trying to replace your chip in a product. - Customer support and liability With limited customer support resources, you don't want to debug your product for a customer without knowing exactly what code is running. This applies both for the end product and the silicon vendor. As an example - what happens if a modified driver bricks the product?

mikegerwitz 9y ago
> Providing open source drivers/stacks will in many cases provide insight into implementation details you do not want competitors to easily understand Competitors will have the resources to reverse engineer; it's not an effective means of hiding implementation details. It _is_ an effective means of wasting free software and security communities' time by forcing them to reverse engineer if they want to use hardware.
- svendbt 9y ago
  They will, but the cost to do so increases by several decades.

brudgers 9y ago

Assuming that the vendors act as they do out of fear biases causal analysis away from simple business cases. One of those cases is that vendors may have developed their firmware with software that limits the ways the firmware can be distributed. Another case is that vendors may have incorporated software licensed from other companies and that license agreement prevents release of the source code...or more simply the third party software may have been distributed as a binary. Finally, the source code may have been developed with custom or proprietary tooling, build systems, etc. that are not generally available and so releasing the source code doesn't mean that people can use it or understand it. Theoretically, it is possible to untangle a big ball of string. Theoretically, it is not possible to untangle a big ball of mud.

Anticapitalist 9y ago
You missed the most likely business case. The hardware across a family with different prices and features is identical. Features are then enabled/disabled by firmware alone. This is frequently done to save on silicon manufacturing costs, but still allows marketing/sales to negotiate on features.
- brudgers 9y ago
  Thanks for pointing out the additional use case that can receive more consideration once fear is removed as a primary motivation. I think that order to be a primary motivating behavior, it would have to also be the case that none of the licensing/tooling issues apply. This suggests that logically it may be less likely as a primary cause due to the dependency.
- JepZ 9y ago
  Well, yeah that is a problem. Does anybody here have an idea how that could be solved? I mean if the firmware would be released with its source everybody could buy the cheap version and load the full-featured firmware version to their hardware. Even if the manufacturer would place some kind of memory on the hardware which holds the feature-level, someone could patch the firmware to ignore that value.