4 ms·

Lobbing a charge like "Arbitrary religious dogma" is pretty much the opposite of a reasoned look at what the goals are here. I find the approach interesting. T

by jrm4 5y ago

Lobbing a charge like "Arbitrary religious dogma" is pretty much the opposite of a reasoned look at what the goals are here. I find the approach interesting. The goal of the Free Software folk was never primarily to "provide the best information to the end user," it is to "preserve software freedom." Guix looks like a possible technical path to do that. Will it work? Will it cause harm? I don't know yet. Either way, the law-slash-tech has always come before "ensuring that it's public-understood and ready" as it should.

dralley 5y ago
Yes, but how does static proprietary firmware blobs burned into ROM "preserve user freedom" vs. dynamic loading, even if the user has complete control? It doesn't, and that's why it's arbitrary.
- jrm4 5y ago
  Those two things are WILDLY DIFFERENT in real life. Broadly, "firmware blobs" are usually put there by companies and other entities that you can much better track (and sue if you have to). Dynamic loading stuff can come from any-darn-where. Apologies, but this should be really obvious.
  - ckastner 5y ago
    The OP referenced CPUs and for at least AMD and Intel CPUs, firmware blobs need to be signed.
    - KingMachiavelli 5y ago
      In theory a government could force AMD or Intel to sign a malicious firmware. That could be distributed as the normal firmware or used to target a specific person. Firmware that ships with the actual CPU is a bit 'safer' because it has a lot more users and eyes looking at it (sort of). Depends on what your attack vector is. Another aspect is that while this policy is worse for Linux-libre users, it is sort of a protest against needing these binary blobs. The hope is certainly that adoption of Linux-libre would result in AMD/Intel not having these non-free software requirements.
      - marcan_42 5y ago
        Nobody is looking at Intel's microcode mask ROM. It's in ROM. You can't even look at it. Microcode is a bad example because the updates are encrypted too, but for the vast majority of the blobs that the FSF hates so much, at least you can look at them and audit them with a disassembler. Meanwhile, the devices with giant firmware ROMs that they openly endorse are not auditable, as you can't see the blob. This policy is making it easier for manufacturers to ship backdoors that will never be detected.
        medo-bear 5y ago
        so after so many posts this is the only one that expresses your point clearly. notice how it does not contain any FUD to the said point, this is definitely a VALID security concern. FSF needs to make these concerns clear. you seem to be very invested in this matter. have you raised these concerns with them? EDIT: having thought about it some more. doesnt isolating blobs to ROMs restrict the problems to ROMs? i mean non-RYF certified hardware already has this problem. the strategy might them be to focus efforts on opening up ROMs. note that this is simply a question. i am not an expert in this field but i am trying to form an informed opinion
        marcan_42 5y ago
        Lots of people have tried to raise concerns such as this one with them. They've stopped listening.
        alexvoda 5y ago
        People have raised these concerns. I have personally raised this concern directly to RMS at one of his conferences. It gets ignored. I believe it is for the same reason religions ignore issues. The FSF totally acts as a religion. The church of his Gnusance St. Ignutiutus. And just like religions it pretends to hold an ethical position while making compromises for practical reasons. Compare religions claiming: - Killing is bad, unless it's about opponents in war. - Slavery is bad, unless it's outsiders who are slaves. - Blobs are bad, unless they are stored on chip flash. The FSF gets criticized precisely for this hypocrisy. And just like religions ignore criticism about their inconsistencies so does the FSF.
  - dralley 5y ago
    Yes, that is obvious. It is in fact one of the benefits dynamic loading provides for people who care about free software. The blob can often be reverse engineered and replaced with free software. And literally everyone signs their firmware.
marcan_42 5y ago
There is no freedom without information. Freedom requires being informed so you can take decisions that you believe are best for you. Lack of knowledge restricts your ability to make the right choices, and thus your freedom. "Freedom" through lack of information is the kind of tactic that repressive regimes use to control their populace. It has no place in an organization claiming to further and support true freedom.
- nextos 5y ago
  I don't fully agree with some of these decisions, but in the defense of Guix I must say as a user replacing linux-libre by the linux kernel is trivial if you are using guix tooling.
- smoldesu 5y ago
  Reading this from the guy who's trying to put Linux on a black-box has a certain flavor of irony, to me.
- jrm4 5y ago
  And exactly when did Guix or the FSF censor anything? I'm not speaking for them, but I'm pretty sure they would say something in the realm of "the information provided by your updates is a false sense of security, so why WOULD we pass that on?"
LargoLasskhyfv 5y ago
Cited from the article: To respect these principles the Guix project (and others) asks to not discuss non-free software, hardware support, or related matters on official channels. These questions and non-free packages are best left to any number of other venues. Guix does not actively hamper a user’s ability to load non-free software or firmware (see freedom 0), but will not support this in any official capacity. That said, the community is very nice and will not kick you from IRC if it comes up (more likely you’ll get some private messages directing you or helping you out), but better to remember their rules. I think that says all. "Hush, hush, and don't look under the rugs!"
- jrm4 5y ago
  I don't think that's what is being "said" at all. This is diplomacy. This is exactly the correct way to act when you are diametrically opposed to something that is widely used, popular, and prevalent -- when you hate something; but understand that other people don't and you're going to have win them over.

by jrm4 5y ago

dralley 5y ago

Yes, but how does static proprietary firmware blobs burned into ROM "preserve user freedom" vs. dynamic loading, even if the user has complete control? It doesn't, and that's why it's arbitrary.

jrm4 5y ago
Those two things are WILDLY DIFFERENT in real life. Broadly, "firmware blobs" are usually put there by companies and other entities that you can much better track (and sue if you have to). Dynamic loading stuff can come from any-darn-where. Apologies, but this should be really obvious.
- ckastner 5y ago
  The OP referenced CPUs and for at least AMD and Intel CPUs, firmware blobs need to be signed.
  - KingMachiavelli 5y ago
    In theory a government could force AMD or Intel to sign a malicious firmware. That could be distributed as the normal firmware or used to target a specific person. Firmware that ships with the actual CPU is a bit 'safer' because it has a lot more users and eyes looking at it (sort of). Depends on what your attack vector is. Another aspect is that while this policy is worse for Linux-libre users, it is sort of a protest against needing these binary blobs. The hope is certainly that adoption of Linux-libre would result in AMD/Intel not having these non-free software requirements.
    - marcan_42 5y ago
      Nobody is looking at Intel's microcode mask ROM. It's in ROM. You can't even look at it. Microcode is a bad example because the updates are encrypted too, but for the vast majority of the blobs that the FSF hates so much, at least you can look at them and audit them with a disassembler. Meanwhile, the devices with giant firmware ROMs that they openly endorse are not auditable, as you can't see the blob. This policy is making it easier for manufacturers to ship backdoors that will never be detected.
      - medo-bear 5y ago
        so after so many posts this is the only one that expresses your point clearly. notice how it does not contain any FUD to the said point, this is definitely a VALID security concern. FSF needs to make these concerns clear. you seem to be very invested in this matter. have you raised these concerns with them? EDIT: having thought about it some more. doesnt isolating blobs to ROMs restrict the problems to ROMs? i mean non-RYF certified hardware already has this problem. the strategy might them be to focus efforts on opening up ROMs. note that this is simply a question. i am not an expert in this field but i am trying to form an informed opinion
        marcan_42 5y ago
        Lots of people have tried to raise concerns such as this one with them. They've stopped listening.
        alexvoda 5y ago
        People have raised these concerns. I have personally raised this concern directly to RMS at one of his conferences. It gets ignored. I believe it is for the same reason religions ignore issues. The FSF totally acts as a religion. The church of his Gnusance St. Ignutiutus. And just like religions it pretends to hold an ethical position while making compromises for practical reasons. Compare religions claiming: - Killing is bad, unless it's about opponents in war. - Slavery is bad, unless it's outsiders who are slaves. - Blobs are bad, unless they are stored on chip flash. The FSF gets criticized precisely for this hypocrisy. And just like religions ignore criticism about their inconsistencies so does the FSF.
- dralley 5y ago
  Yes, that is obvious. It is in fact one of the benefits dynamic loading provides for people who care about free software. The blob can often be reverse engineered and replaced with free software. And literally everyone signs their firmware.

marcan_42 5y ago

There is no freedom without information. Freedom requires being informed so you can take decisions that you believe are best for you. Lack of knowledge restricts your ability to make the right choices, and thus your freedom. "Freedom" through lack of information is the kind of tactic that repressive regimes use to control their populace. It has no place in an organization claiming to further and support true freedom.

nextos 5y ago
I don't fully agree with some of these decisions, but in the defense of Guix I must say as a user replacing linux-libre by the linux kernel is trivial if you are using guix tooling.
smoldesu 5y ago
Reading this from the guy who's trying to put Linux on a black-box has a certain flavor of irony, to me.
jrm4 5y ago
And exactly when did Guix or the FSF censor anything? I'm not speaking for them, but I'm pretty sure they would say something in the realm of "the information provided by your updates is a false sense of security, so why WOULD we pass that on?"

LargoLasskhyfv 5y ago

Cited from the article: To respect these principles the Guix project (and others) asks to not discuss non-free software, hardware support, or related matters on official channels. These questions and non-free packages are best left to any number of other venues. Guix does not actively hamper a user’s ability to load non-free software or firmware (see freedom 0), but will not support this in any official capacity. That said, the community is very nice and will not kick you from IRC if it comes up (more likely you’ll get some private messages directing you or helping you out), but better to remember their rules. I think that says all. "Hush, hush, and don't look under the rugs!"

jrm4 5y ago
I don't think that's what is being "said" at all. This is diplomacy. This is exactly the correct way to act when you are diametrically opposed to something that is widely used, popular, and prevalent -- when you hate something; but understand that other people don't and you're going to have win them over.