3 ms·

It’s complicated. The drivers are probably riddled with security bugs. For the at-home consumer security through diversity and obscurity is sufficient, their a

It’s complicated. The drivers are probably riddled with security bugs. For the at-home consumer security through diversity and obscurity is sufficient, their adversary is not the government but malware authors. Malware authors can and do use source code as their starting point for exploits. Especially vendored known-bad code, the main thing that is hiding in these drivers. The manufacturer’s adversary isn’t consumers. It’s not even other small time manufacturers making knockoffs. It’s Google, Microsoft, Amazon and Apple, who are obviously the biggest violators of the spirit, technological and economic, of open source. As soon as you open source your pathetic network driver, if it happens to benchmark the best in some niche way a Google team needs, it’s not like they go and buy your hardware. It’s just some guy who looks at your source and copies-via-rewriting it internally at Google for the hardware they already own and have source access to. Like how are you going to prove that copyright violation happens? People can barely get GPL judgements against random, low money defendants. Look at how many businesses they are in. Google is making WiFi routers. Apple makes its own GPUs now. What will they start with? Open source code. It’s not just the AppGet guy, or some niche feature. It’s literally everything, top to bottom. It is the core of the trillion dollar market cap culture. Nobody has or will ever succeed in a source code copying lawsuit against Google. Apple is going out there and using your shit until they copy it too. Your chips, your wireless stack, your graphics stack, every little thing. They will copy it. Amazon and Microsoft have far flung offices loaded up with people just violating the spirit of open source and legal force of EULAs via copying all day. That is how some guy survives, gets enough work for a year that matters to the bottom line of a multi billion dollar corporation, far out of sight of the compliance culture at HQ. Every giant company does this. Engineers make careers out of copying open source stuff into some other language, making it seem like it’s clean room implemented when of course it is not. They are the adversaries, not users.

g_p 6y ago
On the point about riddled with bugs, the Qualcomm proprietary drivers absolutely are riddled with them. Even in their closed source and proprietary incarnation, take a skim through Google's monthly android security bulletins, specifically for the Qualcomm closed source components. It's a long time since I did it, but I analysed the frequency and severity of identified vulnerabilities, looking at QCOM open and closed components... The results were fairly easy to predict and guess - the closed components had many more critical vulnerabilities, occuring at a far greater rate. One reason Qualcomm wants to keep these closed is because of IP and the fact they often buy in third party IP (especially in imaging for example). The other reason is because they sell their proprietary userspace drivers to manufacturers as a "board support package", and they need to select the length of time they want updates for. In the old days before treble, when Google changed the HAL every release of android, this meant not being able to run using the old binaries, or having to write shim drivers to wrap old (closed, but exported) function calls with the new expected ones. Post-Treble, the Swiss cheese nature of their driver code means OEMs need these updates to avoid their phones being compromised, ensuring further recurring revenue. The best thing that could happen for Android security would be the opening of the entire Qualcomm userspace drivers, so they could be maintained by some competent developers, and eventually unified into an equivalent project akin to the mainline kernel, so that common code could be shared between generations, and therefore security patches can be applied to past devices' components. And then the next best thing would be for QCOM to open source their modem and RIL (Radio interface layer), because both of those are vulnerability ridden messes of legacy code - I believe their radio baseband firmware is compiled using an utterly ancient compiler still, and lacks even basic secure coding principles. Occasionally you'll see some black box vulnerability research looking into these basebands and they tend to validate the above findings quite nicely.
- an_opabinia 6y ago
  While most people probably agree that the full open sourcing is the best for the consumer, eventually somebody needs to be paid to do the work. It's easy to say in hindsight where Android is massively successful, Google will someday allocate resources to recreate Qualcomm, from scratch, avoid patent issues like the consortia did with VC1, and expire the SoC industry. However that seems hard, also Apple has tried this and still hasn't finished an alternative to Qualcomm. Imagine it was 2006, when there was no one successful to copy. Even if Google were as rich then as it is today, but had the knowledge that Android was definitely going to be a hit, it would definitely not become a phone SoC company - neither did Microsoft nor Blackberry (did Nokia? I honestly don't know). They had the same conviction then in its success, so it didn't matter how much foresight about security issues affecting millions of people there would have been. In any circumstance, they would have not given the kit-and-kaboodle away for free in open source. They'd feel, much like Qualcomm feels today, that they designed something original. Oh, and so now it cannot be shared. Qualcomm got there first and sells this thing, that's the simplest reason they will never open source. They could achieve all your goals in a difference of execution, it's got nothing to do with the license of their source code. People have written secure closed source software. For me, there's an important difference between Linus Torvalds copying Unix to make Linux and some giant company copying some other giant company's stuff. Everyone is dancing around the fact that the two are not equivalent and pretending that they are. Someone eventually has to write original drivers that are good, for complex hardware. That person or entity has to get paid somehow. We're being really naive if we just assume that Google, an advertising company that in recent history never starts something unless there is already ample market success to follow (or displace), would do a good job, just because its engineers are highly paid, have lots of time and do algorithms questions well.
  - cycloptic 6y ago
    >eventually somebody needs to be paid to do the work >That person or entity has to get paid somehow In my experience, it is very hard to get companies to even admit what the real cost of open sourcing something like this is. Lots of them just don't even want to talk about it or show their estimates at all, they just say "we will never open source" like Qualcomm does and the conversation goes nowhere. Even if the price is very high and it takes many years, we still need to start somewhere. Then the industry as a whole can chip away at it slowly, because even very slow progress is better than nothing at all. And what's even worse than no progress is if we just give up and sit around waiting for some other company like Google or Apple to foot 100% of the bill to redo all the work over again from scratch.

g_p 6y ago

On the point about riddled with bugs, the Qualcomm proprietary drivers absolutely are riddled with them. Even in their closed source and proprietary incarnation, take a skim through Google's monthly android security bulletins, specifically for the Qualcomm closed source components. It's a long time since I did it, but I analysed the frequency and severity of identified vulnerabilities, looking at QCOM open and closed components... The results were fairly easy to predict and guess - the closed components had many more critical vulnerabilities, occuring at a far greater rate. One reason Qualcomm wants to keep these closed is because of IP and the fact they often buy in third party IP (especially in imaging for example). The other reason is because they sell their proprietary userspace drivers to manufacturers as a "board support package", and they need to select the length of time they want updates for. In the old days before treble, when Google changed the HAL every release of android, this meant not being able to run using the old binaries, or having to write shim drivers to wrap old (closed, but exported) function calls with the new expected ones. Post-Treble, the Swiss cheese nature of their driver code means OEMs need these updates to avoid their phones being compromised, ensuring further recurring revenue. The best thing that could happen for Android security would be the opening of the entire Qualcomm userspace drivers, so they could be maintained by some competent developers, and eventually unified into an equivalent project akin to the mainline kernel, so that common code could be shared between generations, and therefore security patches can be applied to past devices' components. And then the next best thing would be for QCOM to open source their modem and RIL (Radio interface layer), because both of those are vulnerability ridden messes of legacy code - I believe their radio baseband firmware is compiled using an utterly ancient compiler still, and lacks even basic secure coding principles. Occasionally you'll see some black box vulnerability research looking into these basebands and they tend to validate the above findings quite nicely.

an_opabinia 6y ago
While most people probably agree that the full open sourcing is the best for the consumer, eventually somebody needs to be paid to do the work. It's easy to say in hindsight where Android is massively successful, Google will someday allocate resources to recreate Qualcomm, from scratch, avoid patent issues like the consortia did with VC1, and expire the SoC industry. However that seems hard, also Apple has tried this and still hasn't finished an alternative to Qualcomm. Imagine it was 2006, when there was no one successful to copy. Even if Google were as rich then as it is today, but had the knowledge that Android was definitely going to be a hit, it would definitely not become a phone SoC company - neither did Microsoft nor Blackberry (did Nokia? I honestly don't know). They had the same conviction then in its success, so it didn't matter how much foresight about security issues affecting millions of people there would have been. In any circumstance, they would have not given the kit-and-kaboodle away for free in open source. They'd feel, much like Qualcomm feels today, that they designed something original. Oh, and so now it cannot be shared. Qualcomm got there first and sells this thing, that's the simplest reason they will never open source. They could achieve all your goals in a difference of execution, it's got nothing to do with the license of their source code. People have written secure closed source software. For me, there's an important difference between Linus Torvalds copying Unix to make Linux and some giant company copying some other giant company's stuff. Everyone is dancing around the fact that the two are not equivalent and pretending that they are. Someone eventually has to write original drivers that are good, for complex hardware. That person or entity has to get paid somehow. We're being really naive if we just assume that Google, an advertising company that in recent history never starts something unless there is already ample market success to follow (or displace), would do a good job, just because its engineers are highly paid, have lots of time and do algorithms questions well.
- cycloptic 6y ago
  >eventually somebody needs to be paid to do the work >That person or entity has to get paid somehow In my experience, it is very hard to get companies to even admit what the real cost of open sourcing something like this is. Lots of them just don't even want to talk about it or show their estimates at all, they just say "we will never open source" like Qualcomm does and the conversation goes nowhere. Even if the price is very high and it takes many years, we still need to start somewhere. Then the industry as a whole can chip away at it slowly, because even very slow progress is better than nothing at all. And what's even worse than no progress is if we just give up and sit around waiting for some other company like Google or Apple to foot 100% of the bill to redo all the work over again from scratch.