Re: Meltdown / Spectre

[Christopher Lemmer Webber <cwebber@dustycloud.org>]

Katherine Cox-Buday writes:

> Tobias Geerinckx-Rice <me@tobias.gr> writes:
>
>
>> I think the real and thornier question for GuixSD
>> is: if the recent CPU vulnerabilities require a
>> microcode update to fully mitigate, then how do we
>> square not recommending proprietary globs like
>> this in official channels with giving users all
>> knowledge required to decide for themselves?
>
> Yes, this exactly.
>
> It's a unique (hm, is it?) situation pitting the ideals of copyleft
> against the welfare of users. If an opaque microcode is required to
> successfully mitigate these bugs, what is the moral stance to take?
>
> I don't have an answer and that's why I'm asking here :)

It seems to me that this is one of those "you need to upgrade some
lowest level firmware which you already didn't have access to in order
to keep your system secure"... I dunno if GuixSD should ship something,
but I wouldn't blame anyone updating their microcode for something this
critical.

That said, if the microcode were free in the first place, this would
probably be a lot easier to deal with?