4 ms·

What if the bios, drivers, and blobs were source-available? Obviously a true free license is preferable but I can see why commercial vendors are hesitant to all

What if the bios, drivers, and blobs were source-available? Obviously a true free license is preferable but I can see why commercial vendors are hesitant to allow anybody to make whatever changes they want. From what I understand the GNU project would still reject that on ideological grounds even if it addressed a lot of the theoretical problems (running code where you have no way of knowing what it’s doing)

pydry 4y ago
>commercial vendors are hesitant to allow anybody to make whatever changes they want Why? If a vendor sells a fingerprint scanner or something why do they need the driver to be closed source? Why does somebody tweaking the source bother them? I've never really understood this. Sure, Microsoft word needs to be closed source but why a driver?
- hakfoo 4y ago
  I always figured a lot of it is covering over garbage hardware in software. Whatever "clever" feature it had doesn't actually work and they fake it in the drivers, or they're having to patch around a maze of different buggy hardware revisions. Nobody wants to show the world how that sausage is made.
  - ye-olde-sysrq 4y ago
    I think a lot of it is also just a general amount of fear for (from the companys perspective) no benefit. There's a lot of fear that if the code is visible, you could be sued for its contents or it could be otherwise used against you in court, competitors could "steal" your effort, etc. Plus there's just a lot of belief in the nonfree circles that the software freedom movement is just religious zealot hippies who think software should never be paid for and that microsoft programmers should work for free and starve, and that anyone who does develop novel software should have it immediately ripped off and copied by competitors and make no money because capitalism is bad. (I'm being a bit hyperbolic but not much.)
ye-olde-sysrq 4y ago
Then of course that's better! But still not good enough. If I fix a bug or desire some new functionality and implement it for myself, am I free if I cannot legally share it with my neighbors? Certainly not. Also depending on exactly how they release the source, you may still not know that's what the blob is actually doing. I suspect many vendors, even if forced somehow to provide source, would try to not allow (or make very annoying) building it or signing it. And if you can't build it yourself, or if you can but can't run it and the build isn't bit-perfect reproducible, then you can't know the blob is actually the output of building the source. You could decompile but let's be real, if security researchers looked at Heartbleed not once but twice, specifically in the context of it being a bug, and both times asking if it's a security vulnerability, and said no - then I am not going to believe that a human inspecting decompiled machine code is going to be very good at finding well-hidden malware in blobs.

pydry 4y ago

>commercial vendors are hesitant to allow anybody to make whatever changes they want Why? If a vendor sells a fingerprint scanner or something why do they need the driver to be closed source? Why does somebody tweaking the source bother them? I've never really understood this. Sure, Microsoft word needs to be closed source but why a driver?

hakfoo 4y ago
I always figured a lot of it is covering over garbage hardware in software. Whatever "clever" feature it had doesn't actually work and they fake it in the drivers, or they're having to patch around a maze of different buggy hardware revisions. Nobody wants to show the world how that sausage is made.
- ye-olde-sysrq 4y ago
  I think a lot of it is also just a general amount of fear for (from the companys perspective) no benefit. There's a lot of fear that if the code is visible, you could be sued for its contents or it could be otherwise used against you in court, competitors could "steal" your effort, etc. Plus there's just a lot of belief in the nonfree circles that the software freedom movement is just religious zealot hippies who think software should never be paid for and that microsoft programmers should work for free and starve, and that anyone who does develop novel software should have it immediately ripped off and copied by competitors and make no money because capitalism is bad. (I'm being a bit hyperbolic but not much.)

ye-olde-sysrq 4y ago

Then of course that's better! But still not good enough. If I fix a bug or desire some new functionality and implement it for myself, am I free if I cannot legally share it with my neighbors? Certainly not. Also depending on exactly how they release the source, you may still not know that's what the blob is actually doing. I suspect many vendors, even if forced somehow to provide source, would try to not allow (or make very annoying) building it or signing it. And if you can't build it yourself, or if you can but can't run it and the build isn't bit-perfect reproducible, then you can't know the blob is actually the output of building the source. You could decompile but let's be real, if security researchers looked at Heartbleed not once but twice, specifically in the context of it being a bug, and both times asking if it's a security vulnerability, and said no - then I am not going to believe that a human inspecting decompiled machine code is going to be very good at finding well-hidden malware in blobs.