Slashdot Mirror
Shuttleworth Wants To Get Rid of Proprietary Firmware
jones_supa writes "In a new blog post, the Ubuntu main man Mark Shuttleworth calls for an end to proprietary firmwares such as ACPI. His reasoning is that running any firmware code on your phone, tablet, PC, TV, wifi router, washing machine, server, or the server running the cloud your SAAS app is running on, is a threat vector against you, and NSA's best friend. 'Arguing for ACPI on your next-generation device is arguing for a trojan horse of monumental proportions to be installed in your living room and in your data center. I've been to Troy, there is not much left.' As better solutions, Shuttleworth suggests delivering your innovative code directly to the upstream kernel, or using declarative firmware that describes hardware linkages and dependencies but doesn't include executable code."
Getting rid of ACPI sounds also like a "good luck with that" plan.
Well I call for an end to spurious pluralization, so there!
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
Perfect example would be dell bios. There is no way DELL would allow a USER into bios. Especially one that might cause issues that can't be condensed into auto-replies.
Restore the madness of youth's lechery
I design hardware. I could wait for someone to accept my changes into the Linux Kernel before I start testing it, or I could write some firmware accessible through ACPI.
What Shutters wants is irrelevant. What he needs is open interface specifications to the hardware.
I should use this sig to advertise my book ISBN-13 : 978-1501515132.
So people are just now figuring out that o'l fatty hippy beard Richard Stallman was right all along?
Color me fucking surprised! Any code you can't see can and will be used against you.
RMS says things that are uncomfortable and difficult but painfully true. Don't mistake is disinterest in your feelings (Or business model) as hostility.
Firmware is just fine, as long as it's non-proprietary--free as in freedom.
Precisely how does he intend that a machine boot to the install media without executable firmware?
He does not complain about executable, he complains about proprietary.
Besides, ACPI is complete overkill for booting.
Finally! A year of moderation! Ready for 2019?
So how did RMS posses Shuttleworth's body?
There's an obscure clause deep down in the GPL ...
It must have been something you assimilated. . . .
Great - you don't want ACPI.
I'm looking at my Nokia n900 phone.
(merely because I happen to have a detailed understanding of the design).
Inside it, there are the following closed-source blobs running on turing complete processors.
LED controller firmware.
SIM java virtual machine
SIM raw firmware.
eMMC controller.
SD controller.
Hard-real-time modem controller.
Modem high-level engine.
Bluetooth CPU.
Wifi processor.
Main linux application processor
GPU.
I strongly suspect there is also an embedded processor in:
Power managment controller.
LCD.
Battery charge monitor.
GPS. (It's possible this is just an application running on the closed-source modem high level engine).
https://srlabs.de/rooting-sim-...
http://www.youtube.com/watch?v... (rooting SD cards)
http://www.youtube.com/watch?v... (battery firmware hacking)
Similar efforts have been done with reverse engineering the firmware of bluetooth devices, wifi.
The notion that you should only care about the code running on the CPU being open has always seemed really naive to me.
Its already been decided by the industry that its going to be ACPI.
And Canonical helped desgin it... with ACPI in it
http://www.businesswire.com/ne...
So I don't understand why Mark is suddenly against it. Sudden change of heart leading Ubuntu to be non compatible with other linux operating systems? Again? I don't get it.
Well.. maybe. Or Maybe not. But Definitely not sort of.
He's talking about ACPI. That is, firmware that the kernel is expected to trust and run in it's own context after being loaded. That is quite distinct from bootstrap firmware that is expected to load and jump into the bootloader and then be inactive until the next boot.
BTW, much of it is actually broken in various ways.
It's part of the GPLv666 under the "Demonic Possession" section if you use the "or any later version" clause. I hear Stallman wrote the original in blood, he couldn't find any open source ink. And you really don't want to know how the toe jam is involved.
Live today, because you never know what tomorrow brings
it's called reference frameworks. By the time you get to Userland, a Creative soundcard looks to the software identical to a Turtle Beach. This would be impossible without a reference. One obvious example is DirectX. What you want out of the arse end of the driver layer is a device interface that's compatible with DirectX. What happens between the driver layer and the hardware is entirely up to the manufacturer, but the DirectX compatibility is a certain requirement for even the slightest hope that you'll even get a peep out of it in Windows. And one of the reasons why the Linux driver model, at least from my own personal perspective, is horribly broken. Is there a reference framework for *anything* in Linux?
Political debates have me rolling my eyes so much I think I got optical whiplash. I should sue. - Foamy The Squirrel
I'm talking about the device not the kernel.
I can compile up my own kernel and test my device against it. But I can't go and deploy my device on the myriad computer/OS configurations out there if I need stuff compiled into the kernel. ACPI solves a problem. If your solution that replaces ACPI doesn't solve the problem ACPI solves while also solving the trojan-via-firmware problem, then it's useless. ACPI is horrible, and I'm all for replacing it with something better but I'm not seeing a proposal that does both.
I should use this sig to advertise my book ISBN-13 : 978-1501515132.
Honestly Shuttleworth's reasoning "Binary blobs can contain NSA exploits" is completely irrelevant to ACPI since ACPI byte-code can be completely de-compiled back in to the original source language making it very easy for security researchers to detect any funny business.
Honestly the modern PC has several microcontrollers in it that contain code that the primary CPU never even sees. I personally would consider those a much bigger security threat than ACPI.
So lets ask ourselves... why does he really want to get rid of ACPI? The answer is pretty simple, it going to take a lot of coding effort to get the Linux ACPI stack ready to fully support ACPI 5.0 and Connected Standby found on a lot of brand new laptops. This is just a feeble attempt to mask the fact that puring all his resources in dumb projects like Mir and Unity doesn't leave much left to keep up to date on new open PC platform standards.