> A device with a nonprogrammable ROM could be be harmful, and that could be due to code. But it is not fixable by programming, just like a harmful toaster. So

> A device with a nonprogrammable ROM could be be harmful, and that could be due to code. But it is not fixable by programming, just like a harmful toaster. So why is it better to be harmful and unfixable than harmful and fixable? I can think of one reason: when something can't be updated, whether that be a ROM or hardware itself, device manufacturers are more likely to keep that thing as simple and well-defined as possible, in order to limit risk. Complex functionality, opinionated functionality, potentially user-hostile functionality: that is left to updatable software. But that is only a heuristic, not a fundamental moral value. It cannot justify behavior like [1], where an existing hardware component, designed with the idea that its firmware would be updatable, has a downstream hardware manufacturer put that firmware into something hard-to-update for the sole purpose of getting Respects Your Freedom certification. To be fair, the Librem 5 still does not have RYF cerification (who knows why), but I vaguely (perhaps wrongly) recall there being older examples of similar shenanigans. There is also the example of Linux-libre removing warnings to update insecure microcode. It doesn't make the un-updated microcode any more free! At best it protects against a hypothetical attack where the manufacturer adds a backdoor in an update, but again that seems less like a fundamental moral value, more like a practical question of threat models and security tradeoffs. [1] https://puri.sm/posts/librem5-solving-the-first-fsf-ryf-hurdle/ https://puri.sm/posts/librem5-solving-the-first-fsf-ryf-hurd...