9 ms·

System76 and LVFS

101 points by vec 8y ago

0x0 8y ago
When a vendor talks about adding a "unique blockchain security infrastructure" for firmware updates... I don't even
- jackpot51 8y ago
  Blockchain, however muddied it is today, does have legitimate uses. In this case, we use it to enforce a valid timeline of builds with cryptography.
  - 0x0 8y ago
    I don't get it, do you allow adversary participants in on the network to vote on firmware consensus? What's wrong with regular vendor digital signatures, like everyone else does? :)
    - jackpot51 8y ago
      No. It is a blockchain, but is not distributed or mined. Firmware is built and signed with the signature of the previous build as part of the artifacts. This, in addition with a constraint that the timestamp can never move backwards, means builds must have a valid timeline and it becomes very difficult to hijack the publishing system. Imagine you want to revert firmware for legitimate reasons. As the originator of the firmware, you could revert the source code and have a new build spawn that produces a valid artifact. With our system and with the typical system, this is possible. Now imagine you are an attacker who wants to release an older firmware version, which potentially contains a vulnerability. You have access to the publishing system, but not the build system or signing key. With our system this is impossible, as consumers will not allow moving backwards to an older build. With the typical system, any signed firmware blob can be released at any time, meaning an older version can be made available without having to rebuild. Our build system utilizes a firmware signing hardware device connected to the build server over serial with a strict protocol to ensure that leaking the key is not possible, even if the build server is compromised. In addition, the key is destroyed if this firmware signing device loses power (it does have a battery backup, but it disconnects if the case is opened), and we must deploy a new key in that event through software upgrades on client machines.
      - 0x0 8y ago
        Sounds really complicated, couldn't you just replace all that blockchain verification code with an "if (firmwareToInstall.version < firmwareCurrentlyInstalled.version) return false" after the signature check?
dman 8y ago
The parts casting doubt about lvfs felt out of place to me.
verbatim 8y ago
This article doesn't seem to explain why they have a hard dependency on a proprietary tool to flash the firmware. There are no alternatives to AFUEFI?
- deleted 8y ago
  [deleted]
- emeraldd 8y ago
  Based on there comments in the article, I'd say that was their conclusion: There is no other way to interpret this email other than LVFS won’t work well for us. UpdateCapsule is not supported by over a decade of machines in the field and could not be added without a firmware update.
  - majewsky 8y ago
    Please don't use code blocks for quotes. This is truncated and unreadable on mobile. Just use a normal paragraph with a ">" prefix.
- jackpot51 8y ago
  I am the engineer at System76 that has been working on the low-level firmware update procedure. The only alternative is to reverse engineer the SPI flashing method. We have switched to using FPT, the Intel Flash Programming tool, on new models. This means that we need to reverse engineer the SPI update method, which is something the flashrom project has had success in doing for older Intel chipsets.
  - patrickg_zill 8y ago
    SPI is a standard, right? What is the problem in using SPI?
    - jackpot51 8y ago
      SPI is easy, and well understood. For firmware editing I often use an external flasher for updating the ROM, and use flashrom to do so. Accessing the SPI bus on the Intel chipset, from the computer itself, is undocumented and usually requires reverse engineering.
amyjess 8y ago
The whole "Be wary" section is a really unprofessional swipe borne out of pure retaliation. It isn't germane to the discussion at all, and it's simply FUD spread by System76 in retaliation to Red Hat's security and legal teams balking at System76 wanting them "to ship a untrusted nonfree binary which would get run as root on RHEL on customer machines".
- m-p-3 8y ago
  To be fair, both sides are acting somewhat unprofessionally in this story.
  - ggm 8y ago
    To be fair, both sides are acting somewhat unprofessionally in this story. This. I think the whole "longer lever to move the boulder is to do this in public" is a very very bad trend. Posting stuff like this is inflammatory, on both sides.
    - basementcat 8y ago
      Based on recent electoral trends from around the world, this sort of engaging spirited behavior may be exactly what consumers want.
      - Applejinx 8y ago
        That would be a belief that market behavior delivers optimal outcomes. If you instead think that market dynamics can deliver very bad results, this makes sense as an example of it: sure, consumers like seeing it, but it's not helping and the consumers are wrong to think it is.
      - ggm 8y ago
        Some consumers. I don't believe a majority, but enough that as a win-at-any-cost strategy it works. The majority actually loses in this situation. This is destroy the opposition not grow the market.
discussedbefore 8y ago
RE: Don’t buy System76 hardware and expect to get firmware updates from the LVFS https://news.ycombinator.com/item?id=17037845 https://news.ycombinator.com/item?id=17037845
- dogma1138 8y ago
  My guess would be because AMI or their OEM (Cleve) requires they use it for support.
kentt 8y ago
Just don't touch system76. They're just low quality rebranded Sager laptops with a crap version on Linux. You can just buy the same laptop and if you really like their horrible version of Linux, then put that on there.
- deleted 8y ago
  [deleted]
- craftyguy 8y ago
  Alternatively, there's Purism (https://puri.sm https://puri.sm), who actually take security and build quality seriously. Edit: looks like the system76 downvote brigade is hitting this discussion.
  - jimnotgym 8y ago
    The cheapest Purism seems to be $300 more than the cheapest System76. Is the purpose of your comment to say that more expensive laptops are better?
    - monochromatic 8y ago
      Is that a controversial idea, that more expensive things are often better?
      - yjftsjthsd-h 8y ago
        I might not phrase it that way, but notice that it's not exactly a one-to-one correlation. Given, y'know, that we are busy discussing hardware to run Linux... Which is free in both senses. It's a stronger correlation in hardware, but still imperfect; one brand being higher quality than another while undercutting them by a couple hundred dollars wouldn't shock me.
    - craftyguy 8y ago
      > Is the purpose of your comment to say that more expensive laptops are better? Uh, no. The purpose of my comment is to point out there's a company that builds and sells Linux laptops that are of higher quality. They've put in a lot of work to support Coreboot, disable ME, and have a working TPM. They are trying to reduce their dependence on non-free software. It's a coincidence that in this case you 'get what you pay for'.
acomjean 8y ago
This is the whole open source community destroying (edit: maybe better term would be "damaging") itself. Basically it starts civilly about finding the one best way to do something. They agree to disagree. Then there 2 standards...Then 4, then 8 all not having the effort exerted to make each solution great. Then one party writes something like "don't buy this it not free/ doesn't do this". And in the end 99+% of people can't be bothered with the arguments and end up running Mac/Windows laptops, harming the open source adoption goals of everyone who was arguing before. I still own redhat stock. Corporations love having a point of contact when things go wrong and will pay for that.
- iel99 8y ago
  Hyperbole Dozens of projects have gone this way and the open source community still exists It’s almost as if the notion of one size fits all is a utilitarian idea to simplify production of physical goods We need to maybe look at why we keep trynna force that on more ephemeral ideas I’m not obliged to speak English any one why. Why bother with making sure everyone runs the same code or manages only one or two key projects collectively? Cause Big Corp? Meh.
  - iodiniemetra 8y ago
    Not hyperbole, a real problem that leads to interop issues. For example, the hellish filesystem wars of the mid 2000s. Most distros STILL ship ext4 despite there being better options.
    - jessaustin 8y ago
      Hellish? I was running linux back then (since 97 actually) and while there was a fair amount of confusion, it wasn't due to the many choices we had, and there was nothing hellish about it. The confusion was because we hadn't realized that the right way to handle file system issues is to keep backups and have automated rebuilds. In some tiny minority of cases you also need some flavor of RAID. Other than that, why worry about file systems?
    - iel99 8y ago
JepZ 8y ago
Btw. regarding the Dell XPS advice found in the original post: Three years ago I bought an Dell XPS 15. After a few month the touchscreen was broken (did not respond to any input). As I didn't really need it, it took me a few weeks before I contacted Dell. Their support tried to fix the devices remotely for nearly an hour (flashing firmware updates), the touchscreen was still broken. So they send a technician who tried to repair the device in my kitchen. Sadly he didn't have a replacement screen with him, so a few days later another technician came and replaced the screen. Afterwards the touchscreen worked again. But a few weeks later the Screen started to flicker occasionally. At first I wasn't sure if it was related to the battery level or some software error, as it just happen from time to time and I wasn't using the device that often anyway. But after searching online for the issue and having used the laptop with Windows and Linux for months I am confident that it is another hardware malfunction. Sadly the warranty is long time over. I liked the effort the support put into fixing the device, but I am a little disappointed to have had so many hardware issues for a device with such a high price. And while I had very few driver issues, the overall quality of the product didn't convince me to recommend it :-/
- djsumdog 8y ago
  I had similar issues with an XPS 15. The battery started swelling and popped up the touchpad (I think that's covered under warrant with a recall; just need to take it in). The speakers have no over current protection and blew out (to be fair HPs don't have hardware protection either and can do the same thing). I've also had a lot of cooling and throttling issues. I use to really like Dells and have had other really good Dell laptops. Maybe I just got a bad release and I probably shouldn't swear them off, but I'm probably going to avoid them for a while.
- nvr219 8y ago
  I've been using xps15 for about 6 months and by far the biggest complaint I have is the webcam placement. Hopefully I won't have these other battery swelling/screen issues.
BadassFractal 8y ago
I personally dislike their hardware (I've owned Clevo / Sager for close to 15 years now, they've always felt cheap and plasticky), but I think their PPA and support are great. The problem is that it's not clear what exactly is better out there for Linux enthusiasts who want a MacBook Pro-like experience out of the box. They're the least worst solution on the market as far as I can tell.
- ams6110 8y ago
  > Linux enthusiasts who want a MacBook Pro-like experience out of the box. How big a group is this? Most enthusiasts like the ceremony of installing and configuring their favorite distros to their likings. Or am I misunderstanding what you mean by "enthusiast?"
  - robotbikes 8y ago
    Well considering before I switched to my System76 laptop I had to deal with trying to get a proprietary video chipset working that also controlled my CPU fan. It was not any fun and the result was a machine that would just plain overheat when I ran Linux (also did it on Windows). On the other hand when I had issues with my System76 machine I bought second-hand I was able to get excellent support and the drivers all worked out of the box. So yeah I'd rather buy a machine that has working drivers out of the box than waste more hours of my life trying to troubleshoot getting some kind of proprietary chips working.
    - BadassFractal 8y ago
      Right. I like Linux, but my company pays me to produce results, not to tweak my machine all day just to make it work.
  - BadassFractal 8y ago
    That's fair, I should have said "professional" more than "enthusiast". I'm in the category where I use Linux for a living, but I also don't want to spend a week debugging why WiFi keeps dropping at random intervals instead of actually getting my job done.
Iolaum 8y ago
Since we are giving feedback to system76 I was shopping for a laptop 1+ year ago and was considering system76. When I inquired about buying an Oryx Pro they said that they would disable the onboard gpu and I could not use it. I ended up buying a laptop elsewhere. It took me ~ 6 months to find out how to properly use/switch_to the iGPU (spoiler: acpi_osi kernel parameter in grub) but now I do and can properly chose between battery endurance and performance. Ideally a linux vendor would fix these problems instead of limiting what one can do with the hardware. On the other hand requiring a user to change grub kernel loading parameters isn't a level of customer support that would get positive reviews. However a sizable number of linux users are "enthusiasts" (as people who don't use linux like to call us) and, personally, if I am to pay more for a linux laptop, I expect the manufacturer to facilitate tinkering to get the most out of it (ie allowing me to switch gpus or run any distro I want) instead of hindering that option.

System76 and LVFS

101 points by vec 8y ago

0x0 8y ago

When a vendor talks about adding a "unique blockchain security infrastructure" for firmware updates... I don't even

jackpot51 8y ago
Blockchain, however muddied it is today, does have legitimate uses. In this case, we use it to enforce a valid timeline of builds with cryptography.
- 0x0 8y ago
  I don't get it, do you allow adversary participants in on the network to vote on firmware consensus? What's wrong with regular vendor digital signatures, like everyone else does? :)
  - jackpot51 8y ago
    No. It is a blockchain, but is not distributed or mined. Firmware is built and signed with the signature of the previous build as part of the artifacts. This, in addition with a constraint that the timestamp can never move backwards, means builds must have a valid timeline and it becomes very difficult to hijack the publishing system. Imagine you want to revert firmware for legitimate reasons. As the originator of the firmware, you could revert the source code and have a new build spawn that produces a valid artifact. With our system and with the typical system, this is possible. Now imagine you are an attacker who wants to release an older firmware version, which potentially contains a vulnerability. You have access to the publishing system, but not the build system or signing key. With our system this is impossible, as consumers will not allow moving backwards to an older build. With the typical system, any signed firmware blob can be released at any time, meaning an older version can be made available without having to rebuild. Our build system utilizes a firmware signing hardware device connected to the build server over serial with a strict protocol to ensure that leaking the key is not possible, even if the build server is compromised. In addition, the key is destroyed if this firmware signing device loses power (it does have a battery backup, but it disconnects if the case is opened), and we must deploy a new key in that event through software upgrades on client machines.
    - 0x0 8y ago
      Sounds really complicated, couldn't you just replace all that blockchain verification code with an "if (firmwareToInstall.version < firmwareCurrentlyInstalled.version) return false" after the signature check?

dman 8y ago

The parts casting doubt about lvfs felt out of place to me.

verbatim 8y ago

This article doesn't seem to explain why they have a hard dependency on a proprietary tool to flash the firmware. There are no alternatives to AFUEFI?

deleted 8y ago
[deleted]
emeraldd 8y ago
Based on there comments in the article, I'd say that was their conclusion: There is no other way to interpret this email other than LVFS won’t work well for us. UpdateCapsule is not supported by over a decade of machines in the field and could not be added without a firmware update.
- majewsky 8y ago
  Please don't use code blocks for quotes. This is truncated and unreadable on mobile. Just use a normal paragraph with a ">" prefix.
jackpot51 8y ago
I am the engineer at System76 that has been working on the low-level firmware update procedure. The only alternative is to reverse engineer the SPI flashing method. We have switched to using FPT, the Intel Flash Programming tool, on new models. This means that we need to reverse engineer the SPI update method, which is something the flashrom project has had success in doing for older Intel chipsets.
- patrickg_zill 8y ago
  SPI is a standard, right? What is the problem in using SPI?
  - jackpot51 8y ago
    SPI is easy, and well understood. For firmware editing I often use an external flasher for updating the ROM, and use flashrom to do so. Accessing the SPI bus on the Intel chipset, from the computer itself, is undocumented and usually requires reverse engineering.

amyjess 8y ago

The whole "Be wary" section is a really unprofessional swipe borne out of pure retaliation. It isn't germane to the discussion at all, and it's simply FUD spread by System76 in retaliation to Red Hat's security and legal teams balking at System76 wanting them "to ship a untrusted nonfree binary which would get run as root on RHEL on customer machines".

m-p-3 8y ago
To be fair, both sides are acting somewhat unprofessionally in this story.
- ggm 8y ago
  To be fair, both sides are acting somewhat unprofessionally in this story. This. I think the whole "longer lever to move the boulder is to do this in public" is a very very bad trend. Posting stuff like this is inflammatory, on both sides.
  - basementcat 8y ago
    Based on recent electoral trends from around the world, this sort of engaging spirited behavior may be exactly what consumers want.
    - Applejinx 8y ago
      That would be a belief that market behavior delivers optimal outcomes. If you instead think that market dynamics can deliver very bad results, this makes sense as an example of it: sure, consumers like seeing it, but it's not helping and the consumers are wrong to think it is.
    - ggm 8y ago
      Some consumers. I don't believe a majority, but enough that as a win-at-any-cost strategy it works. The majority actually loses in this situation. This is destroy the opposition not grow the market.

discussedbefore 8y ago

RE: Don’t buy System76 hardware and expect to get firmware updates from the LVFS https://news.ycombinator.com/item?id=17037845 https://news.ycombinator.com/item?id=17037845

dogma1138 8y ago
My guess would be because AMI or their OEM (Cleve) requires they use it for support.

kentt 8y ago

Just don't touch system76. They're just low quality rebranded Sager laptops with a crap version on Linux. You can just buy the same laptop and if you really like their horrible version of Linux, then put that on there.

deleted 8y ago
[deleted]
craftyguy 8y ago
Alternatively, there's Purism (https://puri.sm https://puri.sm), who actually take security and build quality seriously. Edit: looks like the system76 downvote brigade is hitting this discussion.
- jimnotgym 8y ago
  The cheapest Purism seems to be $300 more than the cheapest System76. Is the purpose of your comment to say that more expensive laptops are better?
  - monochromatic 8y ago
    Is that a controversial idea, that more expensive things are often better?
    - yjftsjthsd-h 8y ago
      I might not phrase it that way, but notice that it's not exactly a one-to-one correlation. Given, y'know, that we are busy discussing hardware to run Linux... Which is free in both senses. It's a stronger correlation in hardware, but still imperfect; one brand being higher quality than another while undercutting them by a couple hundred dollars wouldn't shock me.
  - craftyguy 8y ago
    > Is the purpose of your comment to say that more expensive laptops are better? Uh, no. The purpose of my comment is to point out there's a company that builds and sells Linux laptops that are of higher quality. They've put in a lot of work to support Coreboot, disable ME, and have a working TPM. They are trying to reduce their dependence on non-free software. It's a coincidence that in this case you 'get what you pay for'.

acomjean 8y ago

This is the whole open source community destroying (edit: maybe better term would be "damaging") itself. Basically it starts civilly about finding the one best way to do something. They agree to disagree. Then there 2 standards...Then 4, then 8 all not having the effort exerted to make each solution great. Then one party writes something like "don't buy this it not free/ doesn't do this". And in the end 99+% of people can't be bothered with the arguments and end up running Mac/Windows laptops, harming the open source adoption goals of everyone who was arguing before. I still own redhat stock. Corporations love having a point of contact when things go wrong and will pay for that.

iel99 8y ago
Hyperbole Dozens of projects have gone this way and the open source community still exists It’s almost as if the notion of one size fits all is a utilitarian idea to simplify production of physical goods We need to maybe look at why we keep trynna force that on more ephemeral ideas I’m not obliged to speak English any one why. Why bother with making sure everyone runs the same code or manages only one or two key projects collectively? Cause Big Corp? Meh.
- iodiniemetra 8y ago
  Not hyperbole, a real problem that leads to interop issues. For example, the hellish filesystem wars of the mid 2000s. Most distros STILL ship ext4 despite there being better options.
  - jessaustin 8y ago
    Hellish? I was running linux back then (since 97 actually) and while there was a fair amount of confusion, it wasn't due to the many choices we had, and there was nothing hellish about it. The confusion was because we hadn't realized that the right way to handle file system issues is to keep backups and have automated rebuilds. In some tiny minority of cases you also need some flavor of RAID. Other than that, why worry about file systems?
  - iel99 8y ago

JepZ 8y ago

Btw. regarding the Dell XPS advice found in the original post: Three years ago I bought an Dell XPS 15. After a few month the touchscreen was broken (did not respond to any input). As I didn't really need it, it took me a few weeks before I contacted Dell. Their support tried to fix the devices remotely for nearly an hour (flashing firmware updates), the touchscreen was still broken. So they send a technician who tried to repair the device in my kitchen. Sadly he didn't have a replacement screen with him, so a few days later another technician came and replaced the screen. Afterwards the touchscreen worked again. But a few weeks later the Screen started to flicker occasionally. At first I wasn't sure if it was related to the battery level or some software error, as it just happen from time to time and I wasn't using the device that often anyway. But after searching online for the issue and having used the laptop with Windows and Linux for months I am confident that it is another hardware malfunction. Sadly the warranty is long time over. I liked the effort the support put into fixing the device, but I am a little disappointed to have had so many hardware issues for a device with such a high price. And while I had very few driver issues, the overall quality of the product didn't convince me to recommend it :-/

djsumdog 8y ago
I had similar issues with an XPS 15. The battery started swelling and popped up the touchpad (I think that's covered under warrant with a recall; just need to take it in). The speakers have no over current protection and blew out (to be fair HPs don't have hardware protection either and can do the same thing). I've also had a lot of cooling and throttling issues. I use to really like Dells and have had other really good Dell laptops. Maybe I just got a bad release and I probably shouldn't swear them off, but I'm probably going to avoid them for a while.
nvr219 8y ago
I've been using xps15 for about 6 months and by far the biggest complaint I have is the webcam placement. Hopefully I won't have these other battery swelling/screen issues.

BadassFractal 8y ago

I personally dislike their hardware (I've owned Clevo / Sager for close to 15 years now, they've always felt cheap and plasticky), but I think their PPA and support are great. The problem is that it's not clear what exactly is better out there for Linux enthusiasts who want a MacBook Pro-like experience out of the box. They're the least worst solution on the market as far as I can tell.

ams6110 8y ago
> Linux enthusiasts who want a MacBook Pro-like experience out of the box. How big a group is this? Most enthusiasts like the ceremony of installing and configuring their favorite distros to their likings. Or am I misunderstanding what you mean by "enthusiast?"
- robotbikes 8y ago
  Well considering before I switched to my System76 laptop I had to deal with trying to get a proprietary video chipset working that also controlled my CPU fan. It was not any fun and the result was a machine that would just plain overheat when I ran Linux (also did it on Windows). On the other hand when I had issues with my System76 machine I bought second-hand I was able to get excellent support and the drivers all worked out of the box. So yeah I'd rather buy a machine that has working drivers out of the box than waste more hours of my life trying to troubleshoot getting some kind of proprietary chips working.
  - BadassFractal 8y ago
    Right. I like Linux, but my company pays me to produce results, not to tweak my machine all day just to make it work.
- BadassFractal 8y ago
  That's fair, I should have said "professional" more than "enthusiast". I'm in the category where I use Linux for a living, but I also don't want to spend a week debugging why WiFi keeps dropping at random intervals instead of actually getting my job done.

Iolaum 8y ago

Since we are giving feedback to system76 I was shopping for a laptop 1+ year ago and was considering system76. When I inquired about buying an Oryx Pro they said that they would disable the onboard gpu and I could not use it. I ended up buying a laptop elsewhere. It took me ~ 6 months to find out how to properly use/switch_to the iGPU (spoiler: acpi_osi kernel parameter in grub) but now I do and can properly chose between battery endurance and performance. Ideally a linux vendor would fix these problems instead of limiting what one can do with the hardware. On the other hand requiring a user to change grub kernel loading parameters isn't a level of customer support that would get positive reviews. However a sizable number of linux users are "enthusiasts" (as people who don't use linux like to call us) and, personally, if I am to pay more for a linux laptop, I expect the manufacturer to facilitate tinkering to get the most out of it (ie allowing me to switch gpus or run any distro I want) instead of hindering that option.