4 ms·

I am not sure if seeking a “secondary processor” exclusion qualifies as "abuse". I agree that their products are not as "pure" as advocated by some enthusiasts.

I am not sure if seeking a “secondary processor” exclusion qualifies as "abuse". I agree that their products are not as "pure" as advocated by some enthusiasts. But the company itself openly says so and for me that is important. What I do not like is their absolutely ridiculous pricing of additional equipment. For instance, they ask $499 for a 500GB NVMe storage [1], while it can easily be purchased for less than third the price [2]. When I complained about it, their response was: "we are well aware of the problem and will be addressing it within the next few months". That was 4 months ago. [1] https://puri.sm/shop/librem-13/ https://puri.sm/shop/librem-13/ [2] https://www.amazon.com/Samsung-970-EVO-500GB-MZ-V7E500BW/dp/B07BN4NJ2J https://www.amazon.com/Samsung-970-EVO-500GB-MZ-V7E500BW/dp/...

hlandau 8y ago
The secondary processor exception exists for legitimate reasons. If you have some machine with 100% open source boot firmware, Coreboot, etc., that's still worth certifying even if some Ethernet chip turns out to have firmware inside it. What Purism is doing is moving memory init code away from the CPU on which it would normally and most naturally execute (in terms of engineering design decisions) for the express purpose of moving something they can't actually open out of the scope of RYF. And are then brazenly admitting how they are gaming this in the above blogpost. Most people would expect "open source firmware" to mean "open source memory initialisation", because we understand that's something the firmware does. Moving this onto a secondary CPU is literally no better than proprietary firmware. It can't be audited, and if it's able to initialise the memory controller, it can be expected to have full access to the system. They're practically carving out an Intel ME-like boot processor here, with much of the same disadvantages and concerns.
- ljcn 8y ago
  Isn't it fine as long as the secondary processor hands back once the initialization is done? Before the training the memory is unused, and only the "clean" processor has access to it after training. I can't see the threat.
DoofusOfDeath 8y ago
Tangential: I noticed a similar issue with the pricing of SSD drives offered on Dell's Precision Mobile Workstation laptops. Perhaps Dell's SSDs are extra-awesome in some manner that I'm failing to recognize. But otherwise it makes way more sense to just buy your own SSD drives for those laptops, AFAICT.

hlandau 8y ago

The secondary processor exception exists for legitimate reasons. If you have some machine with 100% open source boot firmware, Coreboot, etc., that's still worth certifying even if some Ethernet chip turns out to have firmware inside it. What Purism is doing is moving memory init code away from the CPU on which it would normally and most naturally execute (in terms of engineering design decisions) for the express purpose of moving something they can't actually open out of the scope of RYF. And are then brazenly admitting how they are gaming this in the above blogpost. Most people would expect "open source firmware" to mean "open source memory initialisation", because we understand that's something the firmware does. Moving this onto a secondary CPU is literally no better than proprietary firmware. It can't be audited, and if it's able to initialise the memory controller, it can be expected to have full access to the system. They're practically carving out an Intel ME-like boot processor here, with much of the same disadvantages and concerns.

ljcn 8y ago
Isn't it fine as long as the secondary processor hands back once the initialization is done? Before the training the memory is unused, and only the "clean" processor has access to it after training. I can't see the threat.

DoofusOfDeath 8y ago

Tangential: I noticed a similar issue with the pricing of SSD drives offered on Dell's Precision Mobile Workstation laptops. Perhaps Dell's SSDs are extra-awesome in some manner that I'm failing to recognize. But otherwise it makes way more sense to just buy your own SSD drives for those laptops, AFAICT.