7 ms·

Open-source firmware

247 points by ericdanielski 7y ago

raxxorrax 7y ago
I really hope the author is correct. This would make many things easier. What too much proprietary hardware can do, you can see on the phone market. I doubt many people are happy with what they see here.
- bkircher 7y ago
  Me too. Might also be a competitive factor in the future. Looking at you Intel, AMD.
u35517 7y ago
The call to action targets certain kinds of professionals. What can I, as a regular user, do to help and promote what is best for humanity here?
- voltagex_ 7y ago
  Support projects like this and the companies that undertake them.
bkircher 7y ago
Related: vendors should also support fwupd [1]. [1] https://www.fwupd.org/ https://www.fwupd.org/
justinjlynn 7y ago
Absolutely - nobody should accept anything less than a fully owner controlled and fully auditable system - especially when you're providing secure networking services to customers. Good on them for porting coreboot to this new, modern supermicro platform - it's a gargantuan amount of hard work and I'm glad they did it and published it. However, I have to take issue with this statement: > This is the first time a modern off-the-shelf server platform gains coreboot support, and it is an integral part of realizing our vision of transparent and independently auditable VPN servers. While this is the first modern coreboot system - it is not, by the implication, the first modern server system with fully open source firmware. In fact, I contend that the firmware isn't even fully open source, nor is it fully auditable - the ME taint is still present, as the article clearly states. (EDIT: I did not read the original article terribly clearly - it is extremely clear in this regard - and it doesn't position the system as being "fully" open source. My mistake and I'm sorry. See comments below for response/apology in response to author's correction.) In contrast, the Talos II server system, a POWER9 (powerpc64/LE) system, by Raptor Computing Systems has been shipping for well over a year now - and it has fully open source firmware - and by that I mean everything, supported and developed by both the community, Raptor Computing, other OpenPOWER Foundation members and IBM. The only remaining blob on the base Talos II system is the blob firmware for the onboard NICs - and that's been fully documented and clean-room reverse engineered and the replacement open source project is just about completed (project ortega). It's already usable in beta form, but if it's an issue for you until them - disable them and use an add-in card. However, unlike the Xeon platform referenced as being the first modern coreboot server platform, the Talos II, or any other OpenPOWER system, does not have an invasive management engine in every CPU you have zero access to with zero auditability. It's not enough for the firmware to be open source, I want my systems documentation to look like this: https://wiki.raptorcs.com/wiki/Category:Documentation https://wiki.raptorcs.com/wiki/Category:Documentation - so that I can write that firmware if I have to. I seriously doubt the supermicro board would include schematics, like the Talos II or Blackbird does, either. That said, if instead the existing open source firmware, you really want coreboot - which the Talos II does not yet support - for a specific reason - it's being actively ported to the platform, but not out of necessity, instead it's an exercise in open source firmware diversity - as it should be. If you want a fully auditable, owner controlled, open source platform for your VPNs, or for any other application, x86 based systems aren't it - because, by Intel's ME and AMD's PSP designs, they can't be.
- kfreds 7y ago
  Thank you. I agree with that vision. Please note that you might have misunderstood the article though. Specifically you seem to have missed these two passages: > Modern Intel and AMD processors unfortunately still require some closed-source (and encrypted!) firmware in order to boot. This insanity is unfortunately very much a part of the technological foundations on which we rely daily. > Today marks the day when (mostly) open-source firmware for off-the-shelf modern servers becomes an option.
  - justinjlynn 7y ago
    I did miss that, and I'm sorry. You weren't positing the system as "fully" open source at all, so I certainly apologise for not making that clear in my writing. Quite the opposite, I misunderstood and/or did not read your writing closely enough nor pay enough attention to it - and so I mischaracterised your post. My bad. Thank you for your transparency and forthrightness - and hard work in your involvement in porting coreboot to the new platform. The world needs more people like you. In the future, I'll read more carefully - take some time to digest what I've read - and write in a tone which conveys a bit more charity than I have done.
- mikekchar 7y ago
  I'm with you on your point, but to be fair, it seems like the Talos II motherboard is roughly 7.5x the price of the Supermicro motherboard ($350 vs $2600). I imagine that when they say "off-the-shelf" they really mean "commoditised". Still... I've got to say,though, that the Talos II is tempting if I ever got hold of that much money...
  - justinjlynn 7y ago
    If you need it - you can't buy a fully auditable, fully open source, owner controlled x86 system at any price. Also, you can buy a Talos II Lite or a Blackbird off the shelf for much less. There are options.
    - mikekchar 7y ago
rwmj 7y ago
I'm confused about the details here. Does this run Intel SMM? Does it not run Intel SMM and still manage not to reboot after 30 minutes?
- yjftsjthsd-h 7y ago
  Wikipedia claims that coreboot "includes an open source SMM/SMI handler implementation, for some chipsets" (https://en.wikipedia.org/wiki/System_Management_Mode https://en.wikipedia.org/wiki/System_Management_Mode)
- fox8091 7y ago
  Intel's SMM doesn't actually reset the platform after 30 minutes. Intel's ME does if the firmware is missing on ME 11 and above. However, you can still strip the ME heavily and have it "disabled" via the HAP bit.
amarshall 7y ago
HN post for the corresponding write-up from 9elements: https://news.ycombinator.com/item?id=20644165 https://news.ycombinator.com/item?id=20644165
vardump 7y ago
Just remember in this less than perfect world, firmware bugs can cause physical damage. - Signed, firmware developer.
kfreds 7y ago
I’m the author of the article. Currently on my phone, but feel free to ask questions and I’ll answer as I’m able.
- trax 7y ago
  If you could rename one monument, which would it be and why?
- rasengan 7y ago
  Hey kfreds, great job first and foremost! You’re definitely working on some great stuff. In the world of VPN, it’s great to see another being innovative too. We (Private Internet Access) are working on something similar called zero access. In response to your call to collaborate with other VPN providers, I would love to get on the phone with you to trade notes. My contact info is on my profile here! Hopefully looking forward to it!
  - kfreds 7y ago
    Hi Andrew! Thank you. I definitely took notice when PIA followed our lead and decided to donate to WireGuard as well. I suspect that was your initiative? As far as innovation goes we published our vision for the VPN industry a few months ago. It's transparent and independently auditable VPN servers, through the use of System Transparency: https://mullvad.net/en/blog/2019/6/3/system-transparency-future/ https://mullvad.net/en/blog/2019/6/3/system-transparency-fut... If you are interested in it you are more than welcome to join the implementation effort when we have put some basic things in place, or do your own thing right away. Above all it's important that we start moving in that direction as an industry. We don't really care who gets there first. It is also a more interesting game than the currently dominating one of affiliate marketing using hyperbolical and unverifiable security claims. In a few weeks I will do a talk at the Open Source Firmware Conference together with our technology partner 9eSec ( https://9esec.io/ https://9esec.io/ ), which will coincide with publishing a website as well as more planning of the implementation effort. As far as collaboration goes I have discussed System Transparency at length with IVPN many times, whose values and vision I find very well aligned with Mullvad's. We have an ongoing conversation with them about this and other things. Thanks for the invite to chat, I agree it doesn't hurt to have a one-on-one talk. Even if Mullvad and PIA doesn't turn out to be a good fit for collaboration we should definitely share ideas on our vision for the VPN services market. Our perspective is pretty much all in the blog post about System Transparency. Looking forward to reading more about your idea "zero access". I'll reach out soon!
voltagex_ 7y ago
https://www.supermicro.com/en/products/motherboard/X11SSH-TF https://www.supermicro.com/en/products/motherboard/X11SSH-TF 6th and 7th gen Intel chips (current gen is 9th, with 10th on the horizon). Not a bad board, though.
jchw 7y ago
Wow, as a fan of both Mullvad and Coreboot I am excited to see this happening. I hope to be able to contribute meaningfully to Coreboot in the future. I wonder what caveats come with running Coreboot on modern Intel servers. I thought Boot Guard was an issue?
rurban 7y ago
dang: could the link please changed from the Japanese to the English version?
- kfreds 7y ago
  Good point. Or even without a specific language: https://mullvad.net/blog/2019/8/7/open-source-firmware-future/ https://mullvad.net/blog/2019/8/7/open-source-firmware-futur... Could the submitter or a moderator also change the title to "Open-source firmware is the future"?

247 points by ericdanielski 7y ago

I really hope the author is correct. This would make many things easier. What too much proprietary hardware can do, you can see on the phone market. I doubt many people are happy with what they see here.

bkircher 7y ago
Me too. Might also be a competitive factor in the future. Looking at you Intel, AMD.

u35517 7y ago

The call to action targets certain kinds of professionals. What can I, as a regular user, do to help and promote what is best for humanity here?

voltagex_ 7y ago
Support projects like this and the companies that undertake them.

bkircher 7y ago

Related: vendors should also support fwupd [1]. [1] https://www.fwupd.org/ https://www.fwupd.org/

justinjlynn 7y ago

Absolutely - nobody should accept anything less than a fully owner controlled and fully auditable system - especially when you're providing secure networking services to customers. Good on them for porting coreboot to this new, modern supermicro platform - it's a gargantuan amount of hard work and I'm glad they did it and published it. However, I have to take issue with this statement: > This is the first time a modern off-the-shelf server platform gains coreboot support, and it is an integral part of realizing our vision of transparent and independently auditable VPN servers. While this is the first modern coreboot system - it is not, by the implication, the first modern server system with fully open source firmware. In fact, I contend that the firmware isn't even fully open source, nor is it fully auditable - the ME taint is still present, as the article clearly states. (EDIT: I did not read the original article terribly clearly - it is extremely clear in this regard - and it doesn't position the system as being "fully" open source. My mistake and I'm sorry. See comments below for response/apology in response to author's correction.) In contrast, the Talos II server system, a POWER9 (powerpc64/LE) system, by Raptor Computing Systems has been shipping for well over a year now - and it has fully open source firmware - and by that I mean everything, supported and developed by both the community, Raptor Computing, other OpenPOWER Foundation members and IBM. The only remaining blob on the base Talos II system is the blob firmware for the onboard NICs - and that's been fully documented and clean-room reverse engineered and the replacement open source project is just about completed (project ortega). It's already usable in beta form, but if it's an issue for you until them - disable them and use an add-in card. However, unlike the Xeon platform referenced as being the first modern coreboot server platform, the Talos II, or any other OpenPOWER system, does not have an invasive management engine in every CPU you have zero access to with zero auditability. It's not enough for the firmware to be open source, I want my systems documentation to look like this: https://wiki.raptorcs.com/wiki/Category:Documentation https://wiki.raptorcs.com/wiki/Category:Documentation - so that I can write that firmware if I have to. I seriously doubt the supermicro board would include schematics, like the Talos II or Blackbird does, either. That said, if instead the existing open source firmware, you really want coreboot - which the Talos II does not yet support - for a specific reason - it's being actively ported to the platform, but not out of necessity, instead it's an exercise in open source firmware diversity - as it should be. If you want a fully auditable, owner controlled, open source platform for your VPNs, or for any other application, x86 based systems aren't it - because, by Intel's ME and AMD's PSP designs, they can't be.

kfreds 7y ago
Thank you. I agree with that vision. Please note that you might have misunderstood the article though. Specifically you seem to have missed these two passages: > Modern Intel and AMD processors unfortunately still require some closed-source (and encrypted!) firmware in order to boot. This insanity is unfortunately very much a part of the technological foundations on which we rely daily. > Today marks the day when (mostly) open-source firmware for off-the-shelf modern servers becomes an option.
- justinjlynn 7y ago
  I did miss that, and I'm sorry. You weren't positing the system as "fully" open source at all, so I certainly apologise for not making that clear in my writing. Quite the opposite, I misunderstood and/or did not read your writing closely enough nor pay enough attention to it - and so I mischaracterised your post. My bad. Thank you for your transparency and forthrightness - and hard work in your involvement in porting coreboot to the new platform. The world needs more people like you. In the future, I'll read more carefully - take some time to digest what I've read - and write in a tone which conveys a bit more charity than I have done.
mikekchar 7y ago
I'm with you on your point, but to be fair, it seems like the Talos II motherboard is roughly 7.5x the price of the Supermicro motherboard ($350 vs $2600). I imagine that when they say "off-the-shelf" they really mean "commoditised". Still... I've got to say,though, that the Talos II is tempting if I ever got hold of that much money...
- justinjlynn 7y ago
  If you need it - you can't buy a fully auditable, fully open source, owner controlled x86 system at any price. Also, you can buy a Talos II Lite or a Blackbird off the shelf for much less. There are options.
  - mikekchar 7y ago

rwmj 7y ago

I'm confused about the details here. Does this run Intel SMM? Does it not run Intel SMM and still manage not to reboot after 30 minutes?

yjftsjthsd-h 7y ago
Wikipedia claims that coreboot "includes an open source SMM/SMI handler implementation, for some chipsets" (https://en.wikipedia.org/wiki/System_Management_Mode https://en.wikipedia.org/wiki/System_Management_Mode)
fox8091 7y ago
Intel's SMM doesn't actually reset the platform after 30 minutes. Intel's ME does if the firmware is missing on ME 11 and above. However, you can still strip the ME heavily and have it "disabled" via the HAP bit.

amarshall 7y ago

HN post for the corresponding write-up from 9elements: https://news.ycombinator.com/item?id=20644165 https://news.ycombinator.com/item?id=20644165

vardump 7y ago

Just remember in this less than perfect world, firmware bugs can cause physical damage. - Signed, firmware developer.

kfreds 7y ago

I’m the author of the article. Currently on my phone, but feel free to ask questions and I’ll answer as I’m able.

trax 7y ago
If you could rename one monument, which would it be and why?
rasengan 7y ago
Hey kfreds, great job first and foremost! You’re definitely working on some great stuff. In the world of VPN, it’s great to see another being innovative too. We (Private Internet Access) are working on something similar called zero access. In response to your call to collaborate with other VPN providers, I would love to get on the phone with you to trade notes. My contact info is on my profile here! Hopefully looking forward to it!
- kfreds 7y ago
  Hi Andrew! Thank you. I definitely took notice when PIA followed our lead and decided to donate to WireGuard as well. I suspect that was your initiative? As far as innovation goes we published our vision for the VPN industry a few months ago. It's transparent and independently auditable VPN servers, through the use of System Transparency: https://mullvad.net/en/blog/2019/6/3/system-transparency-future/ https://mullvad.net/en/blog/2019/6/3/system-transparency-fut... If you are interested in it you are more than welcome to join the implementation effort when we have put some basic things in place, or do your own thing right away. Above all it's important that we start moving in that direction as an industry. We don't really care who gets there first. It is also a more interesting game than the currently dominating one of affiliate marketing using hyperbolical and unverifiable security claims. In a few weeks I will do a talk at the Open Source Firmware Conference together with our technology partner 9eSec ( https://9esec.io/ https://9esec.io/ ), which will coincide with publishing a website as well as more planning of the implementation effort. As far as collaboration goes I have discussed System Transparency at length with IVPN many times, whose values and vision I find very well aligned with Mullvad's. We have an ongoing conversation with them about this and other things. Thanks for the invite to chat, I agree it doesn't hurt to have a one-on-one talk. Even if Mullvad and PIA doesn't turn out to be a good fit for collaboration we should definitely share ideas on our vision for the VPN services market. Our perspective is pretty much all in the blog post about System Transparency. Looking forward to reading more about your idea "zero access". I'll reach out soon!

voltagex_ 7y ago

https://www.supermicro.com/en/products/motherboard/X11SSH-TF https://www.supermicro.com/en/products/motherboard/X11SSH-TF 6th and 7th gen Intel chips (current gen is 9th, with 10th on the horizon). Not a bad board, though.

jchw 7y ago

Wow, as a fan of both Mullvad and Coreboot I am excited to see this happening. I hope to be able to contribute meaningfully to Coreboot in the future. I wonder what caveats come with running Coreboot on modern Intel servers. I thought Boot Guard was an issue?

rurban 7y ago

dang: could the link please changed from the Japanese to the English version?

kfreds 7y ago
Good point. Or even without a specific language: https://mullvad.net/blog/2019/8/7/open-source-firmware-future/ https://mullvad.net/blog/2019/8/7/open-source-firmware-futur... Could the submitter or a moderator also change the title to "Open-source firmware is the future"?