Re: Meltdown / Spectre

[Tobias Platen <trisquel@platen-software.de>]

On 10.01.2018 12:49, Adonay Felipe Nogueira wrote:
> I don't know if this serves as guidance as to if microcode is functional
> or not, but from [1] I quote:
> 
> #+BEGIN_QUOTE
> 
> However, there is an exception for secondary embedded processors. The
> exception applies to software delivered inside auxiliary and low-level
> processors and FPGAs, within which software installation is not intended
> after the user obtains the product. This can include, for instance,
> microcode inside a processor, firmware built into an I/O device, or the
> gate pattern of an FPGA. The software in such secondary processors does
> not count as product software.
As an example there is still proprietary formware on the embedded 
controller of the Thinkpads supported by libreboot.
> 
> #+END_QUOTE
> 
> My (perhaps uninformed) opinion is that it's functional data, but not
> the sort of "functional" that every human would be allowed to modify
> after it was first written.
> 
> [1] <https://www.fsf.org/resources/hw/endorsement/criteria>.
> 
> 2018-01-10T01:36:18-0800 Chris Marusich wrote:
>> According to the user named _4of7 in the #libreboot channel of the
>> Freenode IRC network, the email list development@libreboot.org is down.
>> So the Libreboot maintainers have probably not seen this email thread.
>>
>> According to _4of7, currently the best way to contact the Libreboot
>> maintainers is IRC.  It would probably be best to ask there.  If you get
>> a response, please don't forget to update us here on this thread!
>>
>> When I asked in #freenode today, _4of7 responded as follows:
>>
>>    <_4of7> There's not much we can do from the Libreboot side, but there are
>>    <_4of7> mitigations on kernel side... since it's exploitable from javascript
>>    <_4of7> you could also e.g. not run JavaScript. specing on #libreboot IRC had
>>    <_4of7> the idea to run Firefox without the JIT enabled - we both tried to
>>    <_4of7> compile the latest ESR however, with --disable-ion, and it segfaulted.
>>    <_4of7> I tried to build ff 45esr instead, but that build failed.
>>
>> I'm not sure who _4of7 is, so I don't know if they speak for the
>> Libreboot project.
Leah Rowe uses the nickname _4of7 on IRC, she is the founder of Libreboot
>>
>>
>> Does the GNU Project have a policy regarding this sort of thing?  I
>> wasn't able to find any articles on gnu.org that discuss it.
>>
>> If no such policy exists, then should this topic be discussed somewhere
>> like gnu-system-discuss@gnu.org?  I don't know where discussions like
>> this normally take place within the GNU project.  It's definitely a
>> discussion worth having, though.
>