From: David Craven <david@craven.ch>
To: Maxim Cournoyer <maxim.cournoyer@gmail.com>
Cc: guix-devel <guix-devel@gnu.org>,
Workgroup for fully free GNU/Linux distributions
<gnu-linux-libre@nongnu.org>
Subject: Re: Free firmware - A redefinition of the term and a new metric for it's measurement.
Date: Fri, 10 Feb 2017 18:31:34 +0100 [thread overview]
Message-ID: <CAL1_immGW1dj0QnOROOZCuBbiMvN5R6c8JdsVq8QKcQZ1KLVCA@mail.gmail.com> (raw)
In-Reply-To: <87k2948d2q.fsf@gmail.com>
Hi Maxim
> +1. I don't see how having blobs helps security at all.
Well the problem I was getting at is that things are not as fixed as
they may seem.
Quoting wikipedia:
>> Decreasing cost of reprogrammable devices had almost eliminated the market for mask ROM by the year 2000.
Translation: ROM is not RO.
It is not a theoretical threat, and just as dangerous as other threats
that people put a lot of effort in avoiding [0]
I don't see how trusting the manufacturer when buying the product is
any different from trusting him down the road. I was talking about
malicious third parties. Obviously planting something in difficult to
upgrade persistent memory is a lucrative target for attackers -
manipulating firmware becomes plain uninteresting in the other case.
> The companies that should be the rewarded are the ones that release
> firmware, source code, and tool chain. E.g., Thinkpenguin and the TPE-R1100.
> Indeed, we ought to put our money where our mouth is, i.e. back the
> companies which are helping the cause of free software/hardware.
I don't think they actually produce any silicon, toolchain or firmware
themselves. At least I didn't find a link to it. So they are basically
using other peoples silicon, toolchain and firmware. Giving them
credit for complying with the GPL is not quite right either. (But I
don't know who's behind the thinkpenguin and it looks like a great
accomplishement).
To independently verify the claim that the firmware they are using is
indeed fixed, would actually require them to release both schematics
and datasheets of their designs.
[0] https://www.wired.com/2015/02/nsa-firmware-hacking/
next prev parent reply other threads:[~2017-02-10 17:31 UTC|newest]
Thread overview: 25+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-02-03 14:37 Free firmware - A redefinition of the term and a new metric for it's measurement David Craven
2017-02-03 17:40 ` Taylan Ulrich Bayırlı/Kammer
2017-02-03 18:18 ` David Craven
2017-02-03 18:44 ` Christopher Howard
2017-02-03 20:12 ` David Craven
2017-02-05 22:53 ` [GNU-linux-libre] " Maxim Cournoyer
2017-02-10 17:31 ` David Craven [this message]
2017-02-10 18:21 ` Christopher Howard
2017-02-13 7:02 ` Maxim Cournoyer
2017-02-13 8:42 ` [GNU-linux-libre] " John Darrington
2017-02-13 19:24 ` David Craven
2017-02-13 21:21 ` [GNU-linux-libre] " Hartmut Goebel
2017-02-13 22:48 ` David Craven
2017-02-14 6:55 ` Maxim Cournoyer
2017-02-14 10:41 ` [GNU-linux-libre] " David Craven
2017-02-14 17:47 ` Maxim Cournoyer
2017-02-14 12:15 ` Denis 'GNUtoo' Carikli
2017-02-14 18:43 ` [GNU-linux-libre] " David Craven
2017-02-14 20:11 ` Adonay Felipe Nogueira
2017-02-14 20:47 ` David Craven
2017-02-14 20:57 ` Christopher Howard
2017-02-14 21:01 ` David Craven
2017-02-14 21:13 ` [GNU-linux-libre] " David Craven
2017-02-20 7:50 ` Denis 'GNUtoo' Carikli
2017-02-21 12:15 ` David Craven
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAL1_immGW1dj0QnOROOZCuBbiMvN5R6c8JdsVq8QKcQZ1KLVCA@mail.gmail.com \
--to=david@craven.ch \
--cc=gnu-linux-libre@nongnu.org \
--cc=guix-devel@gnu.org \
--cc=maxim.cournoyer@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this external index
https://git.savannah.gnu.org/cgit/guix.git
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.