Re: Automatic downloading of non-free software by stuff in main

From	"G. Branden Robinson" <g.branden.robinson@gmail.com>
Newsgroups	linux.debian.project
Subject	Re: Automatic downloading of non-free software by stuff in main
Date	2017-12-01 19:10 +0100
Message-ID	<uRXV7-7FF-7@gated-at.bofh.it> (permalink)
References	<uRxxD-7SG-1@gated-at.bofh.it> <uRLKi-8pb-3@gated-at.bofh.it> <uRU1b-571-9@gated-at.bofh.it> <uRX8J-7aC-19@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

Hi Adam,

I think you're probably already away of the factual portions of my
claims below, but I'm making them for the benefit of the broader
audience.

At 2017-12-01T18:11:34+0100, Adam Borowski wrote:
> > > No, those derivatives are damage.  While their hearts are in the right
> > > place, they cause data loss and security holes by at least making people on
> > > Intel and AMD machines use known-buggy microcode.
[...]
> While their _intent_ is good, they are telling others to run software with
> known severe bugs.

It's wise to assume that all software that hasn't been formally _and_
independently verified has severe bugs.  And just because a bug is not
known to _you_ doesn't mean it isn't known to government snoops,
corporate revenue-maximizers, and criminals.

> Microcode itself has data loss and local exploits (such
> as an unprivileged user of an unprivileged VM taking over the host machine),
> then often comes in one bunch with IME updates that close remote holes.

And how do we know they aren't opening new ones due to the same factors
(bad design or bad intent) that led to the originals?

> And once remote holes come into play, it's no longer a matter of just what's
> running on your own computer.

We can be confident that all modern Intel- and AMD-based systems are
pre-compromised and running effectively hostile code fresh from the
factory.

1. https://libreboot.org/faq.html#intel
2. https://libreboot.org/faq.html#amd
3. https://lwn.net/Articles/738649/

-- 
Regards,
Branden

Thread

Automatic downloading of non-free software by stuff in main Ian Jackson <ijackson@chiark.greenend.org.uk> - 2017-11-30 15:00 +0100
  Re: Automatic downloading of non-free software by stuff in main Ian Jackson <ijackson@chiark.greenend.org.uk> - 2017-12-01 15:00 +0100
    Re: Automatic downloading of non-free software by stuff in main Andrey Rahmatullin <wrar@debian.org> - 2017-12-01 16:30 +0100
      Re: Automatic downloading of non-free software by stuff in main Enrico Zini <enrico@enricozini.org> - 2017-12-01 16:40 +0100
        Re: Automatic downloading of non-free software by stuff in main Andrey Rahmatullin <wrar@debian.org> - 2017-12-01 17:20 +0100
          Re: Automatic downloading of non-free software by stuff in main Ian Jackson <ijackson@chiark.greenend.org.uk> - 2017-12-01 17:30 +0100
        Re: Automatic downloading of non-free software by stuff in main Ian Jackson <ijackson@chiark.greenend.org.uk> - 2017-12-01 17:20 +0100
      Re: Automatic downloading of non-free software by stuff in main "G. Branden Robinson" <g.branden.robinson@gmail.com> - 2017-12-01 19:10 +0100
    Re: Automatic downloading of non-free software by stuff in main Adam Borowski <kilobyte@angband.pl> - 2017-12-01 18:20 +0100
      Re: Automatic downloading of non-free software by stuff in main Ian Jackson <ijackson@chiark.greenend.org.uk> - 2017-12-01 18:30 +0100
      Re: Automatic downloading of non-free software by stuff in main "G. Branden Robinson" <g.branden.robinson@gmail.com> - 2017-12-01 19:10 +0100
        Re: Automatic downloading of non-free software by stuff in main Adam Borowski <kilobyte@angband.pl> - 2017-12-01 20:10 +0100
        Re: Automatic downloading of non-free software by stuff in main Tollef Fog Heen <tfheen@err.no> - 2017-12-03 12:10 +0100
  Re: Automatic downloading of non-free software by stuff in main "Dr. Bas Wijnen" <wijnen@debian.org> - 2017-12-03 09:00 +0100
  Re: Automatic downloading of non-free software by stuff in main Diane Trout <diane@ghic.org> - 2017-12-05 21:50 +0100
    Re: Automatic downloading of non-free software by stuff in main Andrey Rahmatullin <wrar@debian.org> - 2017-12-06 05:10 +0100
      Re: Automatic downloading of non-free software by stuff in main Ben Hutchings <ben@decadent.org.uk> - 2017-12-06 07:50 +0100
        Re: Automatic downloading of non-free software by stuff in main Henrique de Moraes Holschuh <hmh@debian.org> - 2017-12-07 00:40 +0100
          Re: Automatic downloading of non-free software by stuff in main Ben Hutchings <ben@decadent.org.uk> - 2017-12-07 01:10 +0100
            Re: Automatic downloading of non-free software by stuff in main Michael Stone <mstone@debian.org> - 2017-12-07 01:20 +0100
              Re: Automatic downloading of non-free software by stuff in main Ben Hutchings <ben@decadent.org.uk> - 2017-12-07 02:40 +0100
                Re: Automatic downloading of non-free software by stuff in main Adam Borowski <kilobyte@angband.pl> - 2017-12-07 03:30 +0100
                Re: Automatic downloading of non-free software by stuff in main Mike Hommey <mh@glandium.org> - 2017-12-07 04:20 +0100
                Re: Automatic downloading of non-free software by stuff in main Andrey Rahmatullin <wrar@debian.org> - 2017-12-07 07:10 +0100
                Re: Automatic downloading of non-free software by stuff in main Diane Trout <diane@ghic.org> - 2017-12-07 07:20 +0100
                Re: Automatic downloading of non-free software by stuff in main Andrey Rahmatullin <wrar@debian.org> - 2017-12-07 14:00 +0100
                Re: Automatic downloading of non-free software by stuff in main Holger Levsen <holger@layer-acht.org> - 2017-12-07 14:10 +0100
                Re: Automatic downloading of non-free software by stuff in main Paul Wise <pabs@debian.org> - 2017-12-07 14:20 +0100
                Re: Automatic downloading of non-free software by stuff in main "Paul R. Tagliamonte" <paultag@gmail.com> - 2017-12-07 14:40 +0100
                Re: Automatic downloading of non-free software by stuff in main Ian Jackson <ijackson@chiark.greenend.org.uk> - 2017-12-07 15:00 +0100
                Re: Automatic downloading of non-free software by stuff in main Holger Levsen <holger@layer-acht.org> - 2017-12-07 15:00 +0100
                Re: Automatic downloading of non-free software by stuff in main Lars Wirzenius <liw@liw.fi> - 2017-12-07 15:50 +0100
                Re: Automatic downloading of non-free software by stuff in main "Paul R. Tagliamonte" <paultag@gmail.com> - 2017-12-07 15:20 +0100
                Re: Automatic downloading of non-free software by stuff in main Ian Jackson <ijackson@chiark.greenend.org.uk> - 2017-12-07 17:10 +0100
                technical terms (Re: Automatic downloading of non-free software by  stuff in main) Holger Levsen <holger@layer-acht.org> - 2017-12-07 18:00 +0100
                technical terms (Re: Automatic downloading of non-free software by  stuff in main) Ian Jackson <ijackson@chiark.greenend.org.uk> - 2017-12-07 18:30 +0100
                Re: Automatic downloading of non-free software by stuff in main Jonas Smedegaard <dr@jones.dk> - 2017-12-07 18:30 +0100
                Re: Automatic downloading of non-free software by stuff in main "Paul R. Tagliamonte" <paultag@gmail.com> - 2017-12-07 18:40 +0100
                Re: Automatic downloading of non-free software by stuff in main Diane Trout <diane@ghic.org> - 2017-12-07 19:40 +0100
                Re: Automatic downloading of non-free software by stuff in main Adam Borowski <kilobyte@angband.pl> - 2017-12-07 22:10 +0100
                Re: Automatic downloading of non-free software by stuff in main Diane Trout <diane@ghic.org> - 2017-12-07 23:00 +0100
                Re: Automatic downloading of non-free software by stuff in main "Paul R. Tagliamonte" <paultag@gmail.com> - 2017-12-07 23:10 +0100
                Re: Automatic downloading of non-free software by stuff in main gregor herrmann <gregoa@debian.org> - 2017-12-07 19:30 +0100
                Re: Automatic downloading of non-free software by stuff in main Diane Trout <diane@ghic.org> - 2017-12-07 20:10 +0100
                Re: Automatic downloading of non-free software by stuff in main Andrey Rahmatullin <wrar@debian.org> - 2017-12-07 20:30 +0100
                Re: Automatic downloading of non-free software by stuff in main Diane Trout <diane@ghic.org> - 2017-12-07 21:10 +0100
                Re: Automatic downloading of non-free software by stuff in main Holger Levsen <holger@layer-acht.org> - 2017-12-07 14:00 +0100
    Automatically marking downloaded files (was Re: Automatic downloading  of non-free software by stuff in main) Anthony DeRobertis <anthony@derobert.net> - 2017-12-06 06:30 +0100
      Re: Automatically marking downloaded files (was Re: Automatic downloading of non-free software by stuff in main) Stuart Prescott <stuart@debian.org> - 2017-12-07 02:40 +0100
        Re: Automatically marking downloaded files (was Re: Automatic downloading of non-free software by stuff in main) Ian Jackson <ijackson@chiark.greenend.org.uk> - 2017-12-07 15:00 +0100

csiph-web