4 ms·
What do you guys think of an escrow certification service similar to OU (kosher foods). E.g. UB – un-brickable would certify that a vendor provides access to t
by tonymet 2y ago
What do you guys think of an escrow certification service similar to OU (kosher foods). E.g. UB – un-brickable would certify that a vendor provides access to the bootloader & signing keys to ensure the lifetime access. In the event the product or company ceases to exist, the escrow service would release the assets needed to continue open-source firmware updates.
There could be multiple levels of UB certification ranging from : only keys to fully open sourcing the firmware upon termination
- ryanckulp 2y agoopen to it. perhaps granting an escrow service readonly permission to web server box (not DB) would suffice, as then it could all be pulled down, versus closed source on GH? i'm new to this but we do want to demonstrate sincerity and put our $ where our mouth is.
- inetknght 2y agoI'm not against the idea. I don't want HP-ificiation or Samsung-ification or FAANG-ificiation or any other form of enshittification. Just require _everything_ to be open source to be fully certified. Without open source hardware and software, you're just buying future e-waste. I don't want some workaround like "oh yeah the certificate is for the initial release but you need to update for security and oh by the way the update is not certified". Otherwise, imagine this scenario: Company release a product and pushes out the version for the certification. Updates require new versions to be signed with a particular key. A couple months later, the key is leaked! Okay, so keys are rotated and a new update is pushed and the old key is blocked. What happens to the certification? What use is the certified key? What use is the certified source code? The certification should mandate a user-activatable factory-reset to the certified keys and code, which can't be tampered with by firmware to block or modify a different firmware from being installed.
- TransAtlToonz 2y agoWhy not simply mandate providing code? It doesn't make any sense to wait until the vendor dies to buy.
- ethbr1 2y agoBecause the perfect is the enemy of the good. Escrow triggered by insolvency or product termination would substantially improve on the status quo.
- TransAtlToonz 2y agoMandating source code isn't remotely near perfect either. In an ideal world we wouldn't need currency to organize an economy. People gotta demand more.
- jackmhny 2y agosee WP: Source code escrow [0] [0] https://en.wikipedia.org/wiki/Source_code_escrow https://en.wikipedia.org/wiki/Source_code_escrow
- tonymet 2y agothese seem to be more about archival after the fact. I would like to see a commercial certification & commitment right from the start, similar to OU for food, UL / ECE for electronics
- pabs3 2y agoCurrently Software Heritage only preserve publicly available source code, but I think they are thinking about a future source code escrow service too. https://www.softwareheritage.org/ https://www.softwareheritage.org/