4 ms·

Yes, but how does static proprietary firmware blobs burned into ROM "preserve user freedom" vs. dynamic loading, even if the user has complete control? It does

Yes, but how does static proprietary firmware blobs burned into ROM "preserve user freedom" vs. dynamic loading, even if the user has complete control? It doesn't, and that's why it's arbitrary.

jrm4 5y ago
Those two things are WILDLY DIFFERENT in real life. Broadly, "firmware blobs" are usually put there by companies and other entities that you can much better track (and sue if you have to). Dynamic loading stuff can come from any-darn-where. Apologies, but this should be really obvious.
- ckastner 5y ago
  The OP referenced CPUs and for at least AMD and Intel CPUs, firmware blobs need to be signed.
  - KingMachiavelli 5y ago
    In theory a government could force AMD or Intel to sign a malicious firmware. That could be distributed as the normal firmware or used to target a specific person. Firmware that ships with the actual CPU is a bit 'safer' because it has a lot more users and eyes looking at it (sort of). Depends on what your attack vector is. Another aspect is that while this policy is worse for Linux-libre users, it is sort of a protest against needing these binary blobs. The hope is certainly that adoption of Linux-libre would result in AMD/Intel not having these non-free software requirements.
    - marcan_42 5y ago
      Nobody is looking at Intel's microcode mask ROM. It's in ROM. You can't even look at it. Microcode is a bad example because the updates are encrypted too, but for the vast majority of the blobs that the FSF hates so much, at least you can look at them and audit them with a disassembler. Meanwhile, the devices with giant firmware ROMs that they openly endorse are not auditable, as you can't see the blob. This policy is making it easier for manufacturers to ship backdoors that will never be detected.
      - medo-bear 5y ago
        so after so many posts this is the only one that expresses your point clearly. notice how it does not contain any FUD to the said point, this is definitely a VALID security concern. FSF needs to make these concerns clear. you seem to be very invested in this matter. have you raised these concerns with them? EDIT: having thought about it some more. doesnt isolating blobs to ROMs restrict the problems to ROMs? i mean non-RYF certified hardware already has this problem. the strategy might them be to focus efforts on opening up ROMs. note that this is simply a question. i am not an expert in this field but i am trying to form an informed opinion
        marcan_42 5y ago
        Lots of people have tried to raise concerns such as this one with them. They've stopped listening.
        alexvoda 5y ago
        People have raised these concerns. I have personally raised this concern directly to RMS at one of his conferences. It gets ignored. I believe it is for the same reason religions ignore issues. The FSF totally acts as a religion. The church of his Gnusance St. Ignutiutus. And just like religions it pretends to hold an ethical position while making compromises for practical reasons. Compare religions claiming: - Killing is bad, unless it's about opponents in war. - Slavery is bad, unless it's outsiders who are slaves. - Blobs are bad, unless they are stored on chip flash. The FSF gets criticized precisely for this hypocrisy. And just like religions ignore criticism about their inconsistencies so does the FSF.
        medo-bear 5y ago
        >The FSF totally acts as a religion. The church of his Gnusance St. Ignutiutus. And just like religions it pretends to hold an ethical position while making compromises for practical reasons. so is FSF dogmatic or is it practical? surely they cant be both
        5y ago
- dralley 5y ago
  Yes, that is obvious. It is in fact one of the benefits dynamic loading provides for people who care about free software. The blob can often be reverse engineered and replaced with free software. And literally everyone signs their firmware.

Yes, but how does static proprietary firmware blobs burned into ROM "preserve user freedom" vs. dynamic loading, even if the user has complete control? It doesn't, and that's why it's arbitrary.

jrm4 5y ago

Those two things are WILDLY DIFFERENT in real life. Broadly, "firmware blobs" are usually put there by companies and other entities that you can much better track (and sue if you have to). Dynamic loading stuff can come from any-darn-where. Apologies, but this should be really obvious.

ckastner 5y ago
The OP referenced CPUs and for at least AMD and Intel CPUs, firmware blobs need to be signed.
- KingMachiavelli 5y ago
  In theory a government could force AMD or Intel to sign a malicious firmware. That could be distributed as the normal firmware or used to target a specific person. Firmware that ships with the actual CPU is a bit 'safer' because it has a lot more users and eyes looking at it (sort of). Depends on what your attack vector is. Another aspect is that while this policy is worse for Linux-libre users, it is sort of a protest against needing these binary blobs. The hope is certainly that adoption of Linux-libre would result in AMD/Intel not having these non-free software requirements.
  - marcan_42 5y ago
    Nobody is looking at Intel's microcode mask ROM. It's in ROM. You can't even look at it. Microcode is a bad example because the updates are encrypted too, but for the vast majority of the blobs that the FSF hates so much, at least you can look at them and audit them with a disassembler. Meanwhile, the devices with giant firmware ROMs that they openly endorse are not auditable, as you can't see the blob. This policy is making it easier for manufacturers to ship backdoors that will never be detected.
    - medo-bear 5y ago
      so after so many posts this is the only one that expresses your point clearly. notice how it does not contain any FUD to the said point, this is definitely a VALID security concern. FSF needs to make these concerns clear. you seem to be very invested in this matter. have you raised these concerns with them? EDIT: having thought about it some more. doesnt isolating blobs to ROMs restrict the problems to ROMs? i mean non-RYF certified hardware already has this problem. the strategy might them be to focus efforts on opening up ROMs. note that this is simply a question. i am not an expert in this field but i am trying to form an informed opinion
      - marcan_42 5y ago
        Lots of people have tried to raise concerns such as this one with them. They've stopped listening.
      - alexvoda 5y ago
        People have raised these concerns. I have personally raised this concern directly to RMS at one of his conferences. It gets ignored. I believe it is for the same reason religions ignore issues. The FSF totally acts as a religion. The church of his Gnusance St. Ignutiutus. And just like religions it pretends to hold an ethical position while making compromises for practical reasons. Compare religions claiming: - Killing is bad, unless it's about opponents in war. - Slavery is bad, unless it's outsiders who are slaves. - Blobs are bad, unless they are stored on chip flash. The FSF gets criticized precisely for this hypocrisy. And just like religions ignore criticism about their inconsistencies so does the FSF.
        medo-bear 5y ago
        >The FSF totally acts as a religion. The church of his Gnusance St. Ignutiutus. And just like religions it pretends to hold an ethical position while making compromises for practical reasons. so is FSF dogmatic or is it practical? surely they cant be both
        5y ago
dralley 5y ago
Yes, that is obvious. It is in fact one of the benefits dynamic loading provides for people who care about free software. The blob can often be reverse engineered and replaced with free software. And literally everyone signs their firmware.