Libreboot: Open Letter to the Free Software Community
libreboot.org
libreboot.org
I hope things really are quieting down, and I'm really excited over the possibility of disabling ME. Being unable to get rid of hardware backdoors is essentially why I haven't bought a new laptop in ten years. Remarkably, my ten-year old Inspiron 1420 dellbuntu still works great, and it's delightful to be able to still buy parts for it, but I'm starting to feel the desire for newer hardware.
Don't we have the numbers (and quite frankly the money) to solve this issue at the root? Why can't we (the broader tech community) sell a laptop aimed principally at ourselves. Without Intel ME. Without closed-source firmware. No binary blobs.
Pardon the rant. I'll go back to being naive in silence.
That's a really noble aim, and "we" totally could. But it'd cost millions of dollars in setup capital, the end product would cost significantly more than its competition, and it'd be from a restricted and likely heavily performance-impacted set of components.
Given those restrictions, convincing the people with the money to back it that people won't just keep using Macs or off-the-rack PCs seems like a tall order. I mean, I called it a noble effort in honesty but I probably wouldn't use one because my calculus is such that having commonly-used, high-performance stuff matters more to me right now.
Personally? I need x86, and I need pretty-fast. That shrinks choices to near-zero.
http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc....
That being said, the Cortex A9 in the iMX6 doesn't support that, and therefore it only supports 3840MB (4GB minus a hole for ROM and MMIO).
http://www.amd.com/en-us/innovations/software-technologies/s...
Not sure if you can turn it off, or buy a decent cpu without it.
> It is unlikely that any post-2008 Intel hardware will ever be supported in libreboot, due to severe security and freedom issues; so severe, that the libreboot project recommends avoiding all modern Intel hardware
> It is extremely unlikely that any post-2013 AMD hardware will ever be supported in libreboot, due to severe security and freedom issues; so severe, that the libreboot project recommends avoiding all modern AMD hardware.
One wonders what we are left with and where Libreboot will be in five years, when all the hardware it can run on will be obsolete.
It seems somebody managed to disable ME on some hardware, let's hope there is more to come. However I am not hopeful that they'll be able to do it quickly for newly released processors.
Consider that there's a probably not-small team at Intel responsible for designing and implementing ME. All of them have decided, either explicitly or implicitly, to willingly follow the company plan and keep ME secret. How many of those would, if there were no negative consequence to themselves, defect and leak everything they knew about it (including the critical private keys)? As it is, a handful doing it would be sued into oblivion, but if everyone working on ME somehow decided to defect, it wouldn't be easy to stop them.
Just like with those who work on designing and implementing DRM and other anti-user features, I've always wondered: do these people genuinely believe that they are an overall good and actively promote/advocate for them, or do they personally oppose, but take the job because of some other factors and decide not to stand up for themselves due to the consequences? I mean, if I were forced to work on such things, I would likely not make them so strong and maybe even introduce some weaknesses, because I am fundamentally opposed to it.
With the amount of people on this site who come from tech and entrepreneurial backgrounds, I bet we could fix this issue 10-fold
If anyone actually has access to those keys in a manner in which they could be leaked, that is... utterly terrifying. Like the private keys for root CAs, they likely are under strict access controls making exfiltration quite difficult (hopefully impossible barring multiple levels of process breakdown)
multiple levels of process breakdown
...which is exactly the "everyone working on ME decides to defect" situation I mentioned.
First off, there is no good reason (well, other than typical business reasons) of keeping the stuff closed source. The only thing really needing secrecy are the various secret keys (generated on device), basically. The argument that we accept from management is essentially that it is a competitive advantage to stay closed source, for now.
I've not heard very good arguments against DRM that aren't anchored to the ownership problem Doctorow is often quoted on, i.e. OEMs/vendors are the owners and not the end consumer. In a world of more distributed ownership (that I think is still possible; would love to see a class action against some OEMs), you could have a more distributed DRM, which would be very interesting.
I would love to hear pros/cons about DRM that are not just arguments about ownership.
That's not true. We have the Novena. And the EOMA68 laptop is currently being worked on here: https://www.crowdsupply.com/eoma68/micro-desktop
Have a look at the past few months of messages on the EOMA mailing list to get a sense of the intricacies involved in shipping such a product: http://lists.phcomp.co.uk/mailman/listinfo/arm-netbook
But even if the EOMA68 laptop ships, it must ship with the mali-400 gpu disabled to be fully free because that gpu doesn't have a fully free driver.
So to answer your question about numbers, let me ask here: can anyone reverse-engineer the mali-400 and write a shader compiler for it in their spare time?
I don't believe this is the hardest part (though surely not easy). In my opinion the much harder part is to do it (and be able to show that you did it) in a way that is 100% legal (i.e. strong conditions on clean room reverse engineering etc.).
So for example a few years ago some PowerVR driver source code was leaked (cf. for example http://libv.livejournal.com/26972.html). Of course you are not allowed to use it to build some "open" Linux driver for PowerVR GPUs. We could easily have some PowerVR GPU driver with source code available. The only reason why this does not exist yet is that people care about legality.
So I don't think legality is the fundamental issue. Rather, I think it's that there are probably only 2 people with the domain expertise necessary to lead a successful reverse-engineering project of this particular chip.
As a general response to the grandparent: I think the reason we don't have an affordable, fully-free modern laptop is because it requires many components for which the free software world only has a handful of domain experts. In other words, such a laptop is in the category of problems for which hackers tend to vastly overestimate their potential resources. (I think secure messaging applications also fall into this same category.)
Good luck to gnu and libreboot
While I believe Leah is honest about realizing her mistakes, I fear this part is unreasonably optimistic.
Libreboot as a project has clearly been tainted all across the internet, and we all know how long these things persist when they've first been given a chance to take hold.
I'd love free firmware though so let's hope whatever stains remain won't be too damaging for these projects as a whole (coreboot, librecore and libreboot).
Hopefully this be a lesson to others as well.
https://www.phoronix.com/scan.php?page=news_item&px=Librecor...
Hardly. Sony rootkit, Debian OpenSSL issue from 2008, Reddit CEO spez changing reddit user comments, and many more are things that I see pop up on a weekly basis here on HN, daily on reddit or /.
Hell I couldn't even remember if it was libreboot or openboot that had drama.
For better or worse, Sony, Debian and Reddit are all going strong. Internet dramas mean very little. There was a shitstorm about Uber every other month for the past few years; hell, there's one even now on the HN front page. Each time I hoped the company will finally crumble and die, but no, they're going forward as strong as ever.
Personally, I would be the least forgiving of the issues that were not accidents or were even a company policy, such as the Sony rootkit or the Lenovo Superfish rootkit. I can put the Reddit incident in the same box as this Libreboot drama; personal hardship that spirals out of control very publicly.
I certainly don't consider the project perpetually tainted. People fuck up. People deal with mental illness. People sometimes have poor interpersonal skills (this is not uncommon in technical communities...several BDFLs are widely regarded to be assholes to varying degree). All I usually want from someone is an admission of what went wrong, and a sincere effort to never repeat it and to apologize to the folks directly harmed.
I don't know enough about this to say who owes who an apology or who ought to be making amends. But, really, people have been assholes on the internet since...probably the first day the internet existed. If we let that stop us from working on cool stuff, OSS and the open internet would not be what it is today (hmmm...I guess the internet being what it is today isn't exactly a bragging point or proof of my argument).
So, it's not so simple as forking and coming back when the dust has settled.
We'll see how all this ends up - but given Leah track record - the whole "leaving the GNU project", the allegations, her aggressive behavior towards competition - don't instill me a lot of confidence that the dust is settled for good.
Look at this for example - censorship happened just 3 days ago - they only reverted the issue after community backlash https://trisquel.info/en/forum/libreboot-issues-open-letter-...
I think the very existence of the FSF is proof of the fact that you can't take politics out of even basic engineering questions. The real assumption is that anything apolitical is doing something more than pandering to your views.
Sure, be an activist, but keep it out of work and do it on your own time.
It is a mistake to assume everything done within work hours is apolitical.
It wasn't created to serve as a vehicle to protest a case of alleged sexual discrimination against a friend in a different project.
There are many ways to protest at perceived injustice, but I don't think derailing a volunteer project to do that is good for the movement as a whole.
Yes, but it's a specific political theme. It's not a blank cheque for instrumentalizing your FOSS work for every topic you personally find important.
The whole point of libreboot is to be a purely free software alternative and they can't do that with modern AMD/Intel.
Sure, that means the project will never be mainstream but it doesn't mean it is dead in the water.
And there's a strong security reason to do so. I am motivated to buy an Arm machine which will be soley responsible for my:
+ Banking
+ Cryptocurrency
Because none of those take too much power, and they are all very security sensitive.
The software and motherboard schematics are totally open. It includes an mPCIe wifi card (Ath9k) specifically to avoid binary blob firmware.
If something refurbished is okay, go for a X200; they are pretty good machines. Here's the best part - a Chromebook, without the proprietary Mali drivers, it slow as a piece of shit; an X200 - I can watch a tear-free full-HD movie while compiling something in the background, with both cores at 100%.
Libiquity, Tehnoetic and Vikings still sell those laptops. Or flash one yourself, it's not that hard, and you need like.. 100$ worth of equipment.
LOL. I see a "Sorry for your loss" in your future.
> gives money to companies that sell very closed cpus.
> blame people making some closed cpus free.
:(
Double :<
how is this not paradoxical/delusional?
oh boy, here we go again. An apology full of grandiose but still standing on the previous stubborn point. That is not how apologies work.
The person writing what you quoted isn't apologizing, so I'm not sure what you're on about.
This is the first and only thing I read about what apparently happened, so I might miss some details, but the basic message I'm seeing is "actions regretted, won't happen again, also more people have access now, let's get this thing back on track".
Leah had exclusive control of libreboot. Leah is transgender. The FSF fired someone who happened to be transgender. Leah accused the FSF of doing it because they were transgender. Leah pulled libreboot out of the FSF, burned various bridges by calling people names and retained exclusive control of libreboot, making statements in the project's name.
Apparently she changed her mind and libreboot has transitioned into a more democratic project and she's sorry for what she did and cites personal issues which the letter spells out as gender dysphoria and substance abuse.
A quick googling shows that both the FSF and Leah have mostly refrained from naming names when talking about who got fired but Leah explicitly called out individual members of the FSF (which she apologises for in the letter, indicating she no longer thinks her accusations hold any water). There are also various posts from libreboot contributors complaining about Leah having effectively locked them out of the project and apparently the entire ordeal didn't exactly result in quality software releases (which is to be expected).
tl;dr: maintainer with exclusive access has personal problems, lashes out against FSF, takes project hostage, works personal problems out over the next six months, hands control over project to the other contributors and repents.
It doesn't excuse her childish actions but it helps understand the burden and stress transgender individuals are constantly under.
This and other limitations are located in the aptly named "Methods and Limitations" section.
The underlying facts are not controversial - being transgender puts someone at considerably higher risk of dying by suicide, of attempting suicide, and of having suicidal ideation.
One of the problems we have is that coroners refuse to gather this kind of information, and a bunch of suicide stats are still tied to coroner's decisions.
IOW "being transgender" cannot be identified as a factor putting someone at higher risk. It could be comorbid mental health issues, it could be adverse life experiences related to being transgender or gender-nonconforming.
Adverse life experiences related to being transgender is exactly what we man when we say "being transgender inceases a person's risk of death by suicide".
There's no judgement of trans people in that comment - indeed, the point is to make society more accepting of trans people.
The data simply does not support that conclusion, according to the study itself.
"Respondents who said they had received transition related health care or wanted to have it someday were more likely to report having attempted suicide than those who said they did not want it."
"The survey did not provide information about the timing of reported suicide attempts in relation to receiving transition-related health care, which precluded investigation of transition-related explanations for these patterns."
I agree that society should be more accepting of gender-nonconforming people regardless of their gender identity or approach to transition, if any. I wonder if this lack of acceptance is the cause of suicide, rather than dysphoria which in some cases is alleviated through medical intervention.
Which was weird to me because from the evidence we have they are.
The tl;dr is we don't know, so we shouldn't frame our decisions and policies as if we do know.
Specifically in this question: is a surgical/endocrinological approach or a mental health approach more likely to result in positive outcomes?
If that were true, it would be alarming and possibly grounds for involuntary commitment based on someone being trans.
Fortunately it is not true.
It would be really scary if all of those succeeded.
I wouldn't dismiss unsuccessful suicides. Someone who doesn't succeed or turn back before committing isn't cured or any happier and may very well attempt again or live under a black cloud of depression and stress.
As for your comment on involuntary commitment, it makes no sense. There is a well known "cure" for gender dysphoria and it is gender transition. "after treatment, 26 (2.4%) of the MTF subjects and 7 (1.4%) of the FTM subjects still reported depression"[1]. According to this study, only 2.4% still report depression after transition. There are more studies reporting similar results, find them yourself.
[1] http://www.medscape.com/viewarticle/827713
Edit: I've reread your post and your other post. I understand that your comment on involuntary commitment was meant if my mistake was true and the successful suicide rate was indeed 45%.
This is the only thing in your summary I disagree with. From my reading of the issue and knowledge from following it I think Leah still very much believes in her accusations. She just has realized that at this point even if she's right nothing positive is going to happen and realizes she handled the whole situation awfully so is apologizing for that.
I didn't read anything that suggested that she didn't think the accusations were true anymore.
What I got was that she thinks her prior actions, although incorrectly reasoned, were still reasoned.
It's almost but importantly not identical to "Based on what I knew at the time, I was correct. Based on what I now know, I was incorrect" - except that part of the "what I knew" was how herself was functioning.
As a child, I always used to hate the phrase "that's just an excuse". I'd do something my parents didn't like, they'd ask why, I'd answer, they'd reply - that's just an excuse. It's not, it's the causal reason [that I could identify].
She saying she did things based on actual reasons. She's also saying that those reasons, in hindsight, were wrong, and that those resulting actions were wrong. She's accurately reporting the emotional states at the relevant times. This is a good thing.
Wondering exactly how she slandered those two people in particular, I tried googling her name and those two and got some archived mailinglist (and later checked an archived version of her own denounciation of the FSF on the libreboot.org page). She seems to have wanted to see those two people fired. But also another one - Stephen Mahood (who she names "the bully" on the archived page https://web.archive.org/web/20170114100921/https://libreboot... ) . On an archived mail she seems to call both Stephen and Ruben the bullies. https://lists.gnu.org/archive/html/libreboot/2016-09/msg0005...
Given that her heaviest accusations are leveled (also) against Stephen, and that she feels she especially needs to apologise to the other two guys but NOT to Stephen, should we conclude that she still believes at least that guy was guilty of bullying the unnamend transgendered employee of the FSF?
FWIW Leah never explicitly named the employee because they didn't want her to but Leah made some changes to the libreboot website as well as the accusations made on the mailing list that make it very very obvious who the fired employee was. The changes she made to the Libreboot website actually made Google list the fired employees full name as a related search for a very simple query about the drama. It's still up to this day and searching for the employee's name will also list a related search tying her back to this.
Luckily it doesn't directly confirm that she was the fired employee but still, if some potential employer is looking into her on Google it's way too easy to tie her back to this controversy that she never wanted to be a part of.
I won't bring up any specifics here because it's a difficult topic to discuss without running afoul of the HN rules.
I agree. The exact same thing happens on closed corporate projects, it just happens behind closed doors. You're right - sometimes a co-founder gets pushed out for political reasons, and even within the company most people don't know what the whole story is.
The main difference is things tend to happen out in the open for free software projects, and things happen behind closed doors within corporations. So it just seems like there is more drama, because issues are hashed out in public, things are not swept under the rug.
I was catching up on C++11/14/17 after spending a lot of time in Rust recently and I realized that I see the C++ standards committee as this nameless faceless void, and the Rust team as these friendly people on GitHub and IRC. There's this college kid who thinks using "pre-pooping your pants" as a technical term is a good plan, this Brooklyn hipster who really likes communism, etc. Whether or not I endorse their "personal stuff", I have a sense that there's a community of real people and not just names on a community, and that makes Rust as a language attractive. If I want to contribute something to the language, there are people I can talk to, and there's a clear way for me, as I am, to do that. I have no idea how to propose something to C++ without working for a company that has a seat on the standards committee. Maybe there is a way, but I'm certainly not under the impression that there is a way.
Projects that are more able to attract contributions will be healthier, more technically productive, and more secure (via Linus' Law). It's meaningless to try to focus purely on the technical if you don't have the people to do the technical work.
[1] https://groups.google.com/a/isocpp.org/forum/m/?fromgroups#!...
Rust is primarily community-driven and that is a conscious choice by Mozilla. If it were primarily for Mozilla, we wouldn't run research into how production users use it.
Finally, Mozilla cannot be compared with Apple at all, for all that's bad about them, there's an extreme amount of stuff that happens very much in the open and the clear, with the possibility to influence it.
We have the discussion processes you want, but the language is 2 years old, it's certainly not comparable to C++ on that angle, yet.
There is also a much lower barrier for someone else to take it public for the same reason.
I don't think this is just due to a difference in the degree of openness in dealing with personal issues.
It's also the fact that project maintainers can use the project to advance their personal agenda, while a company cannot do that to the same extent.
For example, imagine if a company terminated a business partnership based only on the suspicion of sexual discrimination at the partner firm.
I think most people would find this premature or inappropriate, especially if the partner firm was not found guilty in a court, or if it did not admit any wrongdoing, and there isn't a history of such allegations at the firm.
Or promoted, or anything inbetween. Some corporate projects live for years because a certain manager can't be seen to have wasted so much money on a failed one. Personal/political issues are everywhere in the corporate world.
The commitment and interdependence of the employment relationship smooths over most disagreements at work. People may not like it, but they stay aboard because, well, what are they going to do, leave? And what's the company going to do, fire them?
No such arrangement exists in voluntary efforts. People will work together fine as long as they all agree on most things. Once a real conflict emerges, without the underlying commitment and interdependence, people just decide it's not worth the frustration and walk away.
You make it sounds like it's a bad thing. Being able to focus your energies on healthy communities in a feature.
> employment [...] smooths over most disagreements at work
No. It just hides them. Backstabbing is popular, so it is disenchantment and cynicism. People biases turn into harsh peer performance feedback, refusal to hire and poor cooperation. Sociopaths get promoted.
No, it's definitely a bug.
Walking away from personal conflicts weakens projects and communities through fragmentation. It feeds the selfish desire for safety and isolation at the expense of developing the more healthy ability to put aside personal differences in pursuit of a greater goal.
As a result, these so-called "healthy communities" will eventually end up more fragile and more fragmented than their original counterparts, especially since personal conflicts are inevitable in any project. What a fine way to derail a movement.
> No. It just hides them...
This is only true for toxic workplaces, but most workplaces are not toxic. There are many tech companies (large and small) that are pro-active about creating a good environment.
Larger institutions usually setup protections against just that kind of drama, but often with the side-effect of reducing motivation.
These days with random unverifiable accusations, extreme political correctness, & activists going through history to dig up mud, open source community has become hazardous to ones career.
To a very cynical person (which I am being for the sake of this comment) it sounds like "I won, I did the damage I wanted; but now my project is hurting and this is damage control."
EDIT: Someone is bitter.
It's platitudes without that. She "punished" them successfully.
But I'm glad the project is still out of the FSF.
No one was upset that she thought the FSF discriminated against her friend; the problem was the way she dealt with the issue, and that is what she was apologizing for.
I don't think it is. It's one thing to have drama around you, but it's quite another to be the source or instigator of it. Leah Rowe is clearly the latter.
It is, but it's yet to be seen if this kind of dramatic behavior is behind the project's leader. It was all very dramatic and still very fresh. An apology is only the first step towards making it past-tense.
There's no reason that libreboot needs to be a political project. There are enough reasons to want our firmware to be free. We rely on our machines for our work, for our art, for our lives.
That's a political position as well.
You can't avoid taking political positions in a public social environment, all you're doing is silently accepting the existing position.
You only have to Google 'site:news.ycombinator.com john deere' to see that it is an economic issue. Replacing your $1000 laptop may not be much of an economic issue for you, but your replacing or paying maintenance for your $500,000 combine harvester most certainly is.
But even if the farmers' actions were somehow non-political, as far as I know the main contributors of Libreboot are not farmers, nor is the Peers Community to which the project belong a trade association of farmers. It's clearly a project motivated by a political idea.
I've heard things about different mini PCIe cards working after flashing to different types of BIOSs.
BTW, a really interesting coreboot distribution is https://github.com/osresearch/heads (focused on boot security)
I can't wait to have a note-taking pen tablet laptop thing, battery life is just a big factor for me. I'm a college student and need to be able to run my laptop from 8AM to 12PM. X220 works great for that. X230T is not there yet for me.
You need to get access to the SPI flash chip on the mother board. They sell some fancy little clips to attach wires, but I just had one of the hardware guys at work tac some wires directly to the chip. Then I used a raspberry pi to flash the image across using their tools. Maybe I had a dodgy connection, but it took several tries of flashing to get it to work correctly.
Once installed it isn't much of a bios. It is mostly just GRUB, you lose all the existing bios settings completely. It lets you boot from different images and thats about it. It does work well once it's set up though.
Here's a few low quality photos of the procedure. http://imgur.com/a/zAQRl
All of us doing OSS must absolutely forgot any personal differences and work towards the cause -- and never forget the cause. There are strongly opinionated people, there are bigots, there are paid trolls, there are sexists and racists -- like in all human groups. In the end though, we still must come together.
It may matter very much to the person who was fired.
- Libreboot exists FSF and publicly denounces it believing that firing was based because of the transgender a la discrimination
- Community gets divided, Libreboot doesn't get as much help/code/growth as before
- Libeboot realised it made a huge mistake (but doesn't admit it), wants things the way they were
Maybe you should instead attribute the downvoting to the very good reason you gave us.
They don't. Read their reply:
> I can't speak to why others downvoted you.
They then go on to explain why they would down vote you and what could have driven others to do the same.
Is it really necessary to air this in public? Did you get her permission?
Though the whole situation has been an unfortunate mess, it takes real bravery to publically admit fault and share those sorts of struggles.
People with this kind of personal politics ALWAYS double down.