Re: Reconsidering Debian’s Inclusion of Non-Free Firmware - A Call for Discussion

From	Stephan Verbücheln <verbuecheln@posteo.de>
Newsgroups	linux.debian.devel
Subject	Re: Reconsidering Debian’s Inclusion of Non-Free Firmware - A Call for Discussion
Date	2025-03-08 23:40 +0100
Message-ID	<KoaZP-4Ekg-13@gated-at.bofh.it> (permalink)
References	<KnK9j-4m3r-1@gated-at.bofh.it> <KnKM2-4mAk-1@gated-at.bofh.it> <Ko0e5-4wRd-1@gated-at.bofh.it> <Ko1MR-4xLh-3@gated-at.bofh.it> <Ko2SB-4ywi-5@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

Am Samstag, dem 08.03.2025 um 14:51 +0100 schrieb Johannes Schauer
Marin Rodrigues:
> If you don't trust the vendor, then it makes no difference whether or
> not new official firmware/microcode can be uploaded/flashed or not.
> If you don't trust the vendor, then the initial microcode that came
> with your device might already be doing things that go against your
> interests.

The trust relationships are more complex than you put it. You have to
trust the chip vendors, the OEMs, the merchants, the delivery company,
the hotel room service etc. etc.
Since Snowden, we know that custom hardware bugs installed by anyone in
the supply chain are a real thing. The recommendation for risk groups
like journalists and lawyers nowadays is to buy random hardware from
the store and pay with cash.
However, I agree with you that we do not have a lot of options when it
comes to affordable consumer hardware. Even the various projects which
try to create openness still depend on proprietary firmware.
The situation is improving compared to what it used to be, but we still
have a long way to go.

Regards
Stephan

Thread

Re: Reconsidering Debian’s Inclusion of Non-Free Firmware - A Call for Discussion Simon Josefsson <simon@josefsson.org> - 2025-03-07 22:00 +0100
  Re: Reconsidering Debian’s Inclusion of Non-Free Firmware - A Call for Discussion Bill Allombert <ballombe@debian.org> - 2025-03-08 12:50 +0100
    Re: Reconsidering Debian’s Inclusion of Non-Free Firmware - A Call for Discussion Simon Josefsson <simon@josefsson.org> - 2025-03-08 13:50 +0100
      Re: Reconsidering Debian’s Inclusion of Non-Free Firmware - A Call for Discussion Aurélien COUDERC <libre@coucouf.fr> - 2025-03-08 14:30 +0100
      Re: Reconsidering Debian’s Inclusion  of Non-Free Firmware - A Call for Discussion Andrey Rakhmatullin <wrar@debian.org> - 2025-03-08 15:00 +0100
        Re: Reconsidering Debian’s Inclusion  of Non-Free Firmware - A Call for Discussion Andrey Rakhmatullin <wrar@debian.org> - 2025-03-10 12:00 +0100
      Re: Reconsidering Debian’s Inclusion of Non-Free Firmware - A Call for Discussion Simon Josefsson <simon@josefsson.org> - 2025-03-08 16:30 +0100
      Re: Reconsidering Debian’s Inclusion of Non-Free Firmware - A Call for Discussion Johannes Schauer Marin Rodrigues <josch@debian.org> - 2025-03-08 16:30 +0100
        Re: Reconsidering Debian’s Inclusion of Non-Free Firmware - A Call for Discussion <tomas@tuxteam.de> - 2025-03-08 16:50 +0100
        Re: Reconsidering Debian’s Inclusion of  Non-Free Firmware - A Call for Discussion Stephan Verbücheln <verbuecheln@posteo.de> - 2025-03-08 23:40 +0100
  Re: Reconsidering Debian’s Inclusion of  Non-Free Firmware - A Call for Discussion Stephan Verbücheln <verbuecheln@posteo.de> - 2025-03-08 16:40 +0100

csiph-web