Re: Reconsidering Debian’s Inclusion of Non-Free Firmware - A Call for Discussion

From	<tomas@tuxteam.de>
Newsgroups	linux.debian.project, linux.debian.devel
Subject	Re: Reconsidering Debian’s Inclusion of Non-Free Firmware - A Call for Discussion
Date	2025-03-08 16:50 +0100
Message-ID	<Ko4B3-4zPc-1@gated-at.bofh.it> (permalink)
References	<KnK9j-4m3r-1@gated-at.bofh.it> <KnKM2-4mAk-1@gated-at.bofh.it> <Ko0e5-4wRd-1@gated-at.bofh.it> <Ko1MR-4xLh-3@gated-at.bofh.it> <Ko2SB-4ywi-5@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Cross-posted to 2 groups.

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

On Sat, Mar 08, 2025 at 02:51:29PM +0100, Johannes Schauer Marin Rodrigues wrote:
> Hi,
> 
> Quoting Simon Josefsson (2025-03-08 13:43:26)
> > My point was that there is no reasonable way to gain confidence about
> > security properties of any piece of non-free microcode.  Everyone can now
> > produce AMD microcode that corrupts your machine in advanced ways that evade
> > detection, but we don't know if such malicious corruption is included in the
> > official microcode.  Having source code for the microcode would help gain
> > confidence in it, and is the reasonable request.  If the request is denied, I
> > would consider the vendor not trustworthy and look into options.
> 
> I do not understand something about this argument.
> 
> If you don't trust the vendor, then it makes no difference whether or not new
> official firmware/microcode can be uploaded/flashed or not. If you don't trust
> the vendor, then the initial microcode that came with your device might already
> be doing things that go against your interests.

Trust in wendors (actually also their trustworthiness) is a function of
time. Remember when Github was bought by Microsoft? Remember when Twitter
was bought by -- uh -- whatever?

Cheers
-- 
t

Back to linux.debian.project | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Re: Reconsidering Debian’s Inclusion of Non-Free Firmware - A Call for Discussion Simon Josefsson <simon@josefsson.org> - 2025-03-07 22:00 +0100
  Re: Reconsidering Debian’s Inclusion of Non-Free Firmware - A Call for Discussion Bill Allombert <ballombe@debian.org> - 2025-03-08 12:50 +0100
    Re: Reconsidering Debian’s Inclusion of Non-Free Firmware - A Call for Discussion Simon Josefsson <simon@josefsson.org> - 2025-03-08 13:50 +0100
      Re: Reconsidering Debian’s Inclusion of Non-Free Firmware - A Call for Discussion Aurélien COUDERC <libre@coucouf.fr> - 2025-03-08 14:30 +0100
      Re: Reconsidering Debian’s Inclusion of Non-Free Firmware - A Call for Discussion Simon Josefsson <simon@josefsson.org> - 2025-03-08 16:30 +0100
        Re: Reconsidering Debian’s Inclusion of Non-Free Firmware - A Call for Discussion Matthias Urlichs <matthias@urlichs.de> - 2025-04-10 11:20 +0200
          Re: Reconsidering Debian’s Inclusion of Non-Free Firmware - A Call for Discussion <tomas@tuxteam.de> - 2025-04-10 14:00 +0200
          Re: Reconsidering Debian’s Inclusion of Non-Free Firmware - A Call for Discussion Simon Josefsson <simon@josefsson.org> - 2025-04-10 14:00 +0200
          Re: Reconsidering Debian’s Inclusion of Non-Free Firmware - A Call for Discussion Henrik Ahlgren <pablo@seestieto.com> - 2025-04-10 14:00 +0200
      Re: Reconsidering Debian’s Inclusion of Non-Free Firmware - A Call for Discussion Johannes Schauer Marin Rodrigues <josch@debian.org> - 2025-03-08 16:30 +0100
        Re: Reconsidering Debian’s Inclusion of Non-Free Firmware - A Call for Discussion <tomas@tuxteam.de> - 2025-03-08 16:50 +0100

csiph-web