1

What is the point of running software that does not violate the four freedoms if our hardware does?

Most of us have modern hardware which contains backdoors that allow manufacturers to access the hardware whenever they want.

To put my question in other words, what's the point of having blob-free kernels and completely free/libre GNU+Linux distros if the majority of us use non-free hardware?

6

I don't think your question admits of an answer better than "you are right, it's not a great idea".

But it may help to know you're not the only person who thinks this way. I heard Georg Greve, ex-president of the FSFE, talk about the hardware-trust problem, and possible solutions from the Open Power Foundation, at FOSDEM 2017.

We need hardware to run our software on. If we want control over our software, we had better have trust in that underlying hardware. There are two routes to that trust; one is faith-based, and the other is through verifiability. At the moment, the CPUs at the heart of the desktop and server equipment that most of us run our free software on are generally made by Intel, and its track record for both justifiable good faith and verifiable openness is not all that good

The talk writeup was published in LWN (from which the above quote comes) but in retrospect I've been impressed at how prescient Greve was. He drew attention to the problem of Intel's Management Engine, the mysterious CPU-behind-the-CPU, and only two months later I was reporting on a zero-day bug that bypassed all access controls in the ME's Active Management Technology.

So yes, it's a problem, and at the end of the day if you don't run your own CPU fabrication plant you will have to trust someone. That said, you can at least try to avoid giving trust to people with a demonstrable record of not deserving it. You can diversify your risk portfolio by building systems from components instead of ordering closed-box solutions from single vendors; any individual component may still be malicious, but its malice may be contained by the lack of assistance from its neighbour components.

My personal colocated server has two hardware RNGs attached to it, to supply strong entropy; one of them comes from a vendor who openly and clearly addresses the issues of checking that your hardware and associated firmware is as they shipped it, and as you would wish it. When you find vendors who want you to be able to trust them, who give you clear pathways to do so, reward them by buying their stuff. Tell them why you like it.

So there are partial solutions; they will require you to do more research and spend more time and money, but then, freedom was never free.

  • @Marco you're welcome. Thank you for doing the right thing and accepting an answer to your question - some don't bother, and it doesn't help the orderly operation of the site when they don't. – MadHatter Jul 9 '18 at 9:53
  • Yes, but... my Fedora system has some 3000 installed packages. I'd need a year or more to thoroughly check to my satisfaction just one of the smallish packages. That before factoring in The Underhanded C Contest... – vonbrand Jul 9 '18 at 14:51
3

You said “hardware”, not specifically “PC” hardware, so let’s talk about why Free software on Proprietary hardware might make sense in this IoT world we’re living in. First, let me say that I’ll be using the work “hardware” here to apply to the entire device, not just the CPU or MCU.

Ok, so I buy a new smart thermostat for my house. Don’t ask me what’s so smart about it, I’m far dumber than it is, so I’m not qualified to say. Anyway, after a few years of use, the user community finds a bug in the software, but the startup that built the thermostat has gone out of business. There’s no way for any of us devs in the user community to fix the issue, because we don’t have the code and legally we can’t reverse engineer it either. We’re either stuck with a buggy thermostat that leaves our homes too cold or we all replace the product we’ve grown to love.

Had the company released the code for the device under a libre license, the user community could have fixed the issue and provided instructions for everyone to update their device. The physical devices could’ve lived far longer than the start up that created them.

It’s also provides the hacker community legal protection for modifying the way the devices they purchased function. In a world where planned obsolescence and companies trying to claim you didn’t purchase a piece of hardware, but a lifetime lease to it, open software on proprietary hardware is still a useful thing to have.

———

Note that opening the source code wouldn’t have necessarily hurt the manufacturer’s sales either. Unlike a pure software product, it would’ve been extremely difficult to undermine the company’s sales because to do so you’d have to reinvent and manufacture hardware to run it on. So, a model of proprietary hardware/open software is a viable one for IoT companies.

1

Pragmatically most of us can learn to use a text editor and a compiler or interpreter, whereas designing circuits and actually making circuits that are small enough, etc. are beyond the capabilities of just about any one individual. Think of the resources it would take to create a super simple computer, much less one capable of running even the earliest versions of Linux.

More important to use hardware that the manufacturers provide Free software for or at least the information needed for others to develop Free software for them (like ATI vs NVidia video cards)

1

There are many reasons why you might want to use F/OS software, and not all of them require absolutely knowing exactly what your computer is doing. You might want to avoid license costs and/or hassles, or have the ability to help maintain software (or just recompile it - there's been times when that's all I wanted) if the original distributor discontinues it. You might want to take advantage of a number of different parties who want pretty much the same software that you want.

There's also using F/OSS because it's the software best suited for you. I'd use Linux and vim if I had to pay for licenses, for example, but that's not using F/OSS because it's F/OSS.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.