From mboxrd@z Thu Jan 1 00:00:00 1970 From: Chris Marusich Subject: Re: Meltdown / Spectre Date: Wed, 10 Jan 2018 01:36:18 -0800 Message-ID: <87tvvukqct.fsf@gmail.com> References: <874lnzcedp.fsf@gmail.com> <20180106174358.GA28436@jasmine.lan> <87lghapeu5.fsf@gmail.com> <87incc6z9o.fsf@gmail.com> <87fu7g436e.fsf@fastmail.com> <87vagad3xx.fsf@netris.org> Mime-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha256; protocol="application/pgp-signature" Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:55324) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1eZCoD-00007a-IG for guix-devel@gnu.org; Wed, 10 Jan 2018 04:36:34 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1eZCo9-00027T-PO for guix-devel@gnu.org; Wed, 10 Jan 2018 04:36:33 -0500 Received: from mail-io0-x234.google.com ([2607:f8b0:4001:c06::234]:43597) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1eZCo9-00026I-JD for guix-devel@gnu.org; Wed, 10 Jan 2018 04:36:29 -0500 Received: by mail-io0-x234.google.com with SMTP id w188so21724639iod.10 for ; Wed, 10 Jan 2018 01:36:29 -0800 (PST) In-Reply-To: <87vagad3xx.fsf@netris.org> (Mark H. Weaver's message of "Tue, 09 Jan 2018 18:10:02 -0500") List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: Mark H Weaver Cc: development@libreboot.org, guix-devel@gnu.org --=-=-= Content-Type: text/plain Content-Transfer-Encoding: quoted-printable Alex Vong writes: > Hello, > > I hope this is on topic. Recently, 2 critical vulnerabilities (see > https://meltdownattack.com/) affecting virtually all intel cpus are > discovered. I am running libreboot x200 (see > https://www.fsf.org/ryf). What should I do right now to patch my laptop? > > Cheers, > Alex According to the user named _4of7 in the #libreboot channel of the Freenode IRC network, the email list development@libreboot.org is down. So the Libreboot maintainers have probably not seen this email thread. According to _4of7, currently the best way to contact the Libreboot maintainers is IRC. It would probably be best to ask there. If you get a response, please don't forget to update us here on this thread! When I asked in #freenode today, _4of7 responded as follows: <_4of7> There's not much we can do from the Libreboot side, but there are <_4of7> mitigations on kernel side... since it's exploitable from javascr= ipt <_4of7> you could also e.g. not run JavaScript. specing on #libreboot IRC= had <_4of7> the idea to run Firefox without the JIT enabled - we both tried to <_4of7> compile the latest ESR however, with --disable-ion, and it segfau= lted. <_4of7> I tried to build ff 45esr instead, but that build failed. I'm not sure who _4of7 is, so I don't know if they speak for the Libreboot project. Mark H Weaver writes: > Marius Bakke writes: > >> Katherine Cox-Buday writes: >> >>> Chris Marusich writes: >>> >>>> Leo Famulari writes: >>> >>>> I wonder: how easy will it be to install those firmware/microcode >>>> updates if you are using GuixSD? In particular, I'm curious about the >>>> case of the Lenovo x200 with libreboot, since that's what I use >>>> personally. >>> >>> I am also interested -- more from a philisophical perspective -- how >>> GuixSD and GNU squares with these kinds of security updates. >> >> In my opinion, CPU microcode falls under "non-functional data", as >> expressly permitted by the GNU FSDG. > > I strongly disagree. CPU microcode is absolutely functional data. > It determines how the CPU functions. Does the GNU Project have a policy regarding this sort of thing? I wasn't able to find any articles on gnu.org that discuss it. If no such policy exists, then should this topic be discussed somewhere like gnu-system-discuss@gnu.org? I don't know where discussions like this normally take place within the GNU project. It's definitely a discussion worth having, though. =2D-=20 Chris --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEy/WXVcvn5+/vGD+x3UCaFdgiRp0FAlpV3pIACgkQ3UCaFdgi Rp13dw/9H2NkZJ93kiyvhEylsG/ynwf1ch9z5irMoZdvTkxd9IQ5yGr3oy9C8XsS 93t63UZeBRvkAeFiI8M9UkK4/6Rhib7dGZJGn4NHW9HTcWXEWVQdvF6ukSxPL5Vr DsTzC8jI9/0CaaxzxgTdli80V++NJk683WxB53FNllK+kxTzO8N1qfpb9nuVc9gm HM7uT8392dqmsc9Rk556zh6cg7pXjREdLP7YdcfLkOUsJyalO+Okc85+grhfJzhP lK88/RQSzZgXJEzOkBB0ew+RyfveJMOmR35qvM66rPynCojAUoHDqjNXcUTDJaQ7 Lve7ubT/uMTbaXwhyRbPAETk2T6I4IiHMK3aVScMtDGJvyX/MeY40i3qLIzKg1sB tANp4+ODO1BDFvXBnFCYc/ofQ+N0/ZXrbLpOnk+Rw1f6FB3rkIxj7ynRmZzvZB17 o2qRiHFSaGUze9Q1q3HWI6iaLhlNx0sjDeuiyqvyV9XHiGHXbKIH+nxwrEdVcq7M EEYq7nKrzOwlu9ds3+knjQAfEcWdD9hWqGL3G8cAXKiNddh33oWjcHGdjKUXDRZZ cFroVTl3t0wfOnEVDpKuqMLqPTYXmlpaHomLyL9BrksFHuvMTwFhjmcdOMLzVx4y MkqW1yXRzX5mLy/Xaj//h7q6XE9XT/pADY9vSRA6wmsxkubOpaU= =E6fM -----END PGP SIGNATURE----- --=-=-=--