Re: Meltdown / Spectre

[Tobias Geerinckx-Rice <me@tobias.gr>]

Katherine,

Not really an answer to your question, I'm afraid. Just some thoughts I
had after hitting ‘Send’ on my previous non-answer.

Katherine Cox-Buday wrote on 09/01/18 at 21:13:
> Tobias Geerinckx-Rice <me@tobias.gr> writes:
>> [...] how do we square not recommending proprietary globs like this
>> in official channels with giving users all knowledge required to
>> decide for themselves?
> 
> Yes, this exactly.
> 
> It's a unique (hm, is it?) situation pitting the ideals of copyleft

I don't think it's unique per se, but it is of another degree entirely
than, for example, asking users to buy a €15 RYF-certified wireless card
instead of pushing proprietary firmware to the one they already have.[0]

The rationale there being that freedom is worth the price, and
(implicitly but importantly) that this price is affordable for anyone
who values their freedom and owns a computer to begin with.

I think that's reasonable.

> against the welfare of users. If an opaque microcode is required to
> successfully mitigate these bugs, what is the moral stance to take> I
> don't have an answer and that's why I'm asking here :)

Logically, it's perfectly sound to extrapolate the above policy to CPUs
and entire systems. I'm half surprised someone hasn't done so yet: buy a
Free(er) system, and you're arguably much better off than with even a
patched non-Free one. And you're voting with your wallet. We all win!

Morally, at least in the short-to-medium term, I'm not convinced.
The smell of privilege becomes hard to ignore with the costs and other
assumptions involved.

Like you, I'm very curious to know what others think.

                                 * * *

Note: despite my musing above, I don't *actually* expect GNU Guix to
start shipping or even recommending proprietary software, including
microcode. It opens cans of worms and then the worms get everywhere.

Kind regards,

T G-R

[0]: I'll not address the question of whether a device with proprietary
firmware that you can or must update is more or less free than a device
with proprietary firmware that you can't.