4 ms·

> what storage device does it have? I guarantee it runs non-free firmware from flash. RMS is pretty consistently clear that software intended to be upgraded by

> what storage device does it have? I guarantee it runs non-free firmware from flash. RMS is pretty consistently clear that software intended to be upgraded by the end user must be free. Software/firmware that is not intended to ever be changed or upgraded by the end user is more or less the same as circuitry and outside the scope of the Free Software movement. > There is little difference between this and AMD's graphics firmware blob files. AMD's blobs are intended to be installed by the end user. Both the firmware that you upload to the card when you use it, or binary drivers that run on your main CPU. Those are both software that you receive and execute as an end user which is fundamentally different from the gates and firmware fused into your device.

mindslight 8y ago
Except that firmware isn't "fused" into your device, but simply on an undocumented flash chip - the days of windowed EPROM are long gone. So RMS is compromising here, in my opinion incorrectly. If we stop talking about a device as being "Free" but rather use the FSF's verbiage of "respects your freedom", then I would actually argue that AMD's firmware blobs are more-RYF than SSD firmware. The former I can be pretty sure AMD did a decent job at the code signing, meaning they're the only party that can use the device to disrespect my freedom. Whereas the SSD firmware interface remains more opaque, so there's a decent chance that anybody could reverse engineer the SSD and surreptitiously modify the firmware on mine to undermine my freedom! Of course you can insulate yourself from the SSD by using full disk encryption and considering your SATA controller a security boundary. And that's my entire point - we need to evolve these definitions to incorporate this type of nuance.
- the_why_of_y 8y ago
  I don't see a difference between RYF-ness of CPU microcode and SSD firmware. The main practical difference in the context of TFA is that distros typically bundle CPU microcode but not SSD firmware, hence the question is unlikely to come up in that context for SSD firmware, but that doesn't mean that it's not a problem. Btw, the AMD CPU microcode is fused into the CPU, otherwise it wouldn't boot; there's an additional SRAM area where the microcode update is applied; for details see https://media.ccc.de/v/35c3-9614-inside_the_amd_microcode_rom https://media.ccc.de/v/35c3-9614-inside_the_amd_microcode_ro... To elaborate on your last point, I'd always use software encryption with SSDs, because with the opaque firmware wear-leveling it's essentially impossible to be sure that anything is actually physically deleted from SSDs, and if it isn't physically deleted it can be read by a custom firmware.
  - mindslight 8y ago
    I was referring to AMD's graphics cards. They have a binary firmware blob that basically must be loaded, but the loading itself is done by Free software. I don't see how this is any different from a RYF perspective than if AMD had put another flash chip on the BOM for storing it cold. That is, assuming a competent signature scheme for both. So the card itself doesn't RYF, but it can be used to display the output from a RYF computer. And unfortunately barring a better graphics option based on open firmware, these are the compromises we have to make. RMS recognizes this - I just think the manner in which he framed the compromise is a bit unnuanced and out of date. Rather than finding reasons to ignore least-worst blobs, we should be talking about boundaries between Free/non-free components. SSDs are an interesting case, because the hard drive interface abstraction is so simple and longstanding, we just kind of assume it's a good boundary. But if you want to pop back into abstract Freedom land, imagine what the market would look like if vendors weren't able to market around decommoditizing software features. For example, if the FTL were done by Free software (perhaps on the main CPU), there would be no worries about certain lines of drives getting corrupted due to power failures! (And yes, totally agree about FDE. I actually just changed my router back to being a general purpose Linux box, and it felt quite odd installing that with no FDE).
    - the_why_of_y 8y ago
      I'm sorry, no idea how I managed to jump from AMD GPUs to AMD CPUs :-)
sokoloff 8y ago
> RMS is pretty consistently clear that software intended to be upgraded by the end user must be free. Software/firmware that is not intended to ever be changed or upgraded by the end user is more or less the same as circuitry and outside the scope of the Free Software movement. That seems somewhat circular in definition on the edges. I can and have updated firmware on hard-drives (always opaque binary blobs from the vendor, but definitely changes, updates, and bug fixes not directly analogous to circuitry).

mindslight 8y ago

Except that firmware isn't "fused" into your device, but simply on an undocumented flash chip - the days of windowed EPROM are long gone. So RMS is compromising here, in my opinion incorrectly. If we stop talking about a device as being "Free" but rather use the FSF's verbiage of "respects your freedom", then I would actually argue that AMD's firmware blobs are more-RYF than SSD firmware. The former I can be pretty sure AMD did a decent job at the code signing, meaning they're the only party that can use the device to disrespect my freedom. Whereas the SSD firmware interface remains more opaque, so there's a decent chance that anybody could reverse engineer the SSD and surreptitiously modify the firmware on mine to undermine my freedom! Of course you can insulate yourself from the SSD by using full disk encryption and considering your SATA controller a security boundary. And that's my entire point - we need to evolve these definitions to incorporate this type of nuance.

the_why_of_y 8y ago
I don't see a difference between RYF-ness of CPU microcode and SSD firmware. The main practical difference in the context of TFA is that distros typically bundle CPU microcode but not SSD firmware, hence the question is unlikely to come up in that context for SSD firmware, but that doesn't mean that it's not a problem. Btw, the AMD CPU microcode is fused into the CPU, otherwise it wouldn't boot; there's an additional SRAM area where the microcode update is applied; for details see https://media.ccc.de/v/35c3-9614-inside_the_amd_microcode_rom https://media.ccc.de/v/35c3-9614-inside_the_amd_microcode_ro... To elaborate on your last point, I'd always use software encryption with SSDs, because with the opaque firmware wear-leveling it's essentially impossible to be sure that anything is actually physically deleted from SSDs, and if it isn't physically deleted it can be read by a custom firmware.
- mindslight 8y ago
  I was referring to AMD's graphics cards. They have a binary firmware blob that basically must be loaded, but the loading itself is done by Free software. I don't see how this is any different from a RYF perspective than if AMD had put another flash chip on the BOM for storing it cold. That is, assuming a competent signature scheme for both. So the card itself doesn't RYF, but it can be used to display the output from a RYF computer. And unfortunately barring a better graphics option based on open firmware, these are the compromises we have to make. RMS recognizes this - I just think the manner in which he framed the compromise is a bit unnuanced and out of date. Rather than finding reasons to ignore least-worst blobs, we should be talking about boundaries between Free/non-free components. SSDs are an interesting case, because the hard drive interface abstraction is so simple and longstanding, we just kind of assume it's a good boundary. But if you want to pop back into abstract Freedom land, imagine what the market would look like if vendors weren't able to market around decommoditizing software features. For example, if the FTL were done by Free software (perhaps on the main CPU), there would be no worries about certain lines of drives getting corrupted due to power failures! (And yes, totally agree about FDE. I actually just changed my router back to being a general purpose Linux box, and it felt quite odd installing that with no FDE).
  - the_why_of_y 8y ago
    I'm sorry, no idea how I managed to jump from AMD GPUs to AMD CPUs :-)

sokoloff 8y ago

> RMS is pretty consistently clear that software intended to be upgraded by the end user must be free. Software/firmware that is not intended to ever be changed or upgraded by the end user is more or less the same as circuitry and outside the scope of the Free Software movement. That seems somewhat circular in definition on the edges. I can and have updated firmware on hard-drives (always opaque binary blobs from the vendor, but definitely changes, updates, and bug fixes not directly analogous to circuitry).