Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.project > #9670
| From | Adam Borowski <kilobyte@angband.pl> |
|---|---|
| Newsgroups | linux.debian.project |
| Subject | Re: Automatic downloading of non-free software by stuff in main |
| Date | 2017-12-01 20:10 +0100 |
| Message-ID | <uRYRg-8gR-27@gated-at.bofh.it> (permalink) |
| References | <uRxxD-7SG-1@gated-at.bofh.it> <uRLKi-8pb-3@gated-at.bofh.it> <uRU1b-571-9@gated-at.bofh.it> <uRX8J-7aC-19@gated-at.bofh.it> <uRXV7-7FF-7@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
On Fri, Dec 01, 2017 at 01:07:59PM -0500, G. Branden Robinson wrote: > Hi Adam, > > I think you're probably already away of the factual portions of my > claims below, but I'm making them for the benefit of the broader > audience. > > At 2017-12-01T18:11:34+0100, Adam Borowski wrote: > > > > No, those derivatives are damage. While their hearts are in the right > > > > place, they cause data loss and security holes by at least making people on > > > > Intel and AMD machines use known-buggy microcode. > [...] > > While their _intent_ is good, they are telling others to run software with > > known severe bugs. > > It's wise to assume that all software that hasn't been formally _and_ > independently verified has severe bugs. And just because a bug is not > known to _you_ doesn't mean it isn't known to government snoops, > corporate revenue-maximizers, and criminals. Earlier in this thread I wrote: --- Yeah, opaque encrypted microcode can be used to sneak in new backdoors, but that doesn't make past bugs (and "oh, those foul hackers found one of our backdoors, it was a honest bug, really!") any better. At the very least, you get new TLA-only backdoors while those fixed are usable by both TLAs and any random punk. Likewise, closed firmware for your wifi card is evil, but still strictly better than the same code burned into ROM: you get some bug fixes, and can go back to a past version. Sweeping non-free code under the carpet doesn't help in any way -- if you have to use it, it's better kept where you can see it. --- It's the difference between suspected (but indeed likely) brand new holes that are known to one corporation and a few spook agencies, vs old holes which have been disseminated to a wide array of bad guys. Plus, a long list of non-intentional data loss bugs. > > Microcode itself has data loss and local exploits (such > > as an unprivileged user of an unprivileged VM taking over the host machine), > > then often comes in one bunch with IME updates that close remote holes. > > And how do we know they aren't opening new ones due to the same factors > (bad design or bad intent) that led to the originals? > > > And once remote holes come into play, it's no longer a matter of just what's > > running on your own computer. > > We can be confident that all modern Intel- and AMD-based systems are > pre-compromised and running effectively hostile code fresh from the > factory. With this, I agree. It looks like some alternatives have appeared recently, like Talos 2 that's marketed as open (if you trust IBM), and fully free drivers (including the equivalent of ME/PSP) for Pinebook have finally been posted (currently in a form outside my u-boot/ATF/SPL skills, vagrantc is trying to figure it out). But then, Talos is a wee bit pricey for a client machine, while Pinebook's performance is abysmal. Meow! -- ⢀⣴⠾⠻⢶⣦⠀ Mozilla's Hippocritic Oath: "Keep trackers off your trail" ⣾⠁⢰⠒⠀⣿⡁ blah blah evading "tracking technology" blah blah ⢿⡄⠘⠷⠚⠋⠀ "https://click.e.mozilla.org/?qs=e7bb0dcf14b1013fca3820..." ⠈⠳⣄⠀⠀⠀⠀ (same for all links)
Back to linux.debian.project | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
Automatic downloading of non-free software by stuff in main Ian Jackson <ijackson@chiark.greenend.org.uk> - 2017-11-30 15:00 +0100
Re: Automatic downloading of non-free software by stuff in main Ian Jackson <ijackson@chiark.greenend.org.uk> - 2017-12-01 15:00 +0100
Re: Automatic downloading of non-free software by stuff in main Andrey Rahmatullin <wrar@debian.org> - 2017-12-01 16:30 +0100
Re: Automatic downloading of non-free software by stuff in main Enrico Zini <enrico@enricozini.org> - 2017-12-01 16:40 +0100
Re: Automatic downloading of non-free software by stuff in main Andrey Rahmatullin <wrar@debian.org> - 2017-12-01 17:20 +0100
Re: Automatic downloading of non-free software by stuff in main Ian Jackson <ijackson@chiark.greenend.org.uk> - 2017-12-01 17:30 +0100
Re: Automatic downloading of non-free software by stuff in main Ian Jackson <ijackson@chiark.greenend.org.uk> - 2017-12-01 17:20 +0100
Re: Automatic downloading of non-free software by stuff in main "G. Branden Robinson" <g.branden.robinson@gmail.com> - 2017-12-01 19:10 +0100
Re: Automatic downloading of non-free software by stuff in main Adam Borowski <kilobyte@angband.pl> - 2017-12-01 18:20 +0100
Re: Automatic downloading of non-free software by stuff in main Ian Jackson <ijackson@chiark.greenend.org.uk> - 2017-12-01 18:30 +0100
Re: Automatic downloading of non-free software by stuff in main "G. Branden Robinson" <g.branden.robinson@gmail.com> - 2017-12-01 19:10 +0100
Re: Automatic downloading of non-free software by stuff in main Adam Borowski <kilobyte@angband.pl> - 2017-12-01 20:10 +0100
Re: Automatic downloading of non-free software by stuff in main Tollef Fog Heen <tfheen@err.no> - 2017-12-03 12:10 +0100
Re: Automatic downloading of non-free software by stuff in main "Dr. Bas Wijnen" <wijnen@debian.org> - 2017-12-03 09:00 +0100
Re: Automatic downloading of non-free software by stuff in main Diane Trout <diane@ghic.org> - 2017-12-05 21:50 +0100
Re: Automatic downloading of non-free software by stuff in main Andrey Rahmatullin <wrar@debian.org> - 2017-12-06 05:10 +0100
Re: Automatic downloading of non-free software by stuff in main Ben Hutchings <ben@decadent.org.uk> - 2017-12-06 07:50 +0100
Re: Automatic downloading of non-free software by stuff in main Henrique de Moraes Holschuh <hmh@debian.org> - 2017-12-07 00:40 +0100
Re: Automatic downloading of non-free software by stuff in main Ben Hutchings <ben@decadent.org.uk> - 2017-12-07 01:10 +0100
Re: Automatic downloading of non-free software by stuff in main Michael Stone <mstone@debian.org> - 2017-12-07 01:20 +0100
Re: Automatic downloading of non-free software by stuff in main Ben Hutchings <ben@decadent.org.uk> - 2017-12-07 02:40 +0100
Re: Automatic downloading of non-free software by stuff in main Adam Borowski <kilobyte@angband.pl> - 2017-12-07 03:30 +0100
Re: Automatic downloading of non-free software by stuff in main Mike Hommey <mh@glandium.org> - 2017-12-07 04:20 +0100
Re: Automatic downloading of non-free software by stuff in main Andrey Rahmatullin <wrar@debian.org> - 2017-12-07 07:10 +0100
Re: Automatic downloading of non-free software by stuff in main Diane Trout <diane@ghic.org> - 2017-12-07 07:20 +0100
Re: Automatic downloading of non-free software by stuff in main Andrey Rahmatullin <wrar@debian.org> - 2017-12-07 14:00 +0100
Re: Automatic downloading of non-free software by stuff in main Holger Levsen <holger@layer-acht.org> - 2017-12-07 14:10 +0100
Re: Automatic downloading of non-free software by stuff in main Paul Wise <pabs@debian.org> - 2017-12-07 14:20 +0100
Re: Automatic downloading of non-free software by stuff in main "Paul R. Tagliamonte" <paultag@gmail.com> - 2017-12-07 14:40 +0100
Re: Automatic downloading of non-free software by stuff in main Ian Jackson <ijackson@chiark.greenend.org.uk> - 2017-12-07 15:00 +0100
Re: Automatic downloading of non-free software by stuff in main Holger Levsen <holger@layer-acht.org> - 2017-12-07 15:00 +0100
Re: Automatic downloading of non-free software by stuff in main Lars Wirzenius <liw@liw.fi> - 2017-12-07 15:50 +0100
Re: Automatic downloading of non-free software by stuff in main "Paul R. Tagliamonte" <paultag@gmail.com> - 2017-12-07 15:20 +0100
Re: Automatic downloading of non-free software by stuff in main Ian Jackson <ijackson@chiark.greenend.org.uk> - 2017-12-07 17:10 +0100
technical terms (Re: Automatic downloading of non-free software by stuff in main) Holger Levsen <holger@layer-acht.org> - 2017-12-07 18:00 +0100
technical terms (Re: Automatic downloading of non-free software by stuff in main) Ian Jackson <ijackson@chiark.greenend.org.uk> - 2017-12-07 18:30 +0100
Re: Automatic downloading of non-free software by stuff in main Jonas Smedegaard <dr@jones.dk> - 2017-12-07 18:30 +0100
Re: Automatic downloading of non-free software by stuff in main "Paul R. Tagliamonte" <paultag@gmail.com> - 2017-12-07 18:40 +0100
Re: Automatic downloading of non-free software by stuff in main Diane Trout <diane@ghic.org> - 2017-12-07 19:40 +0100
Re: Automatic downloading of non-free software by stuff in main Adam Borowski <kilobyte@angband.pl> - 2017-12-07 22:10 +0100
Re: Automatic downloading of non-free software by stuff in main Diane Trout <diane@ghic.org> - 2017-12-07 23:00 +0100
Re: Automatic downloading of non-free software by stuff in main "Paul R. Tagliamonte" <paultag@gmail.com> - 2017-12-07 23:10 +0100
Re: Automatic downloading of non-free software by stuff in main gregor herrmann <gregoa@debian.org> - 2017-12-07 19:30 +0100
Re: Automatic downloading of non-free software by stuff in main Diane Trout <diane@ghic.org> - 2017-12-07 20:10 +0100
Re: Automatic downloading of non-free software by stuff in main Andrey Rahmatullin <wrar@debian.org> - 2017-12-07 20:30 +0100
Re: Automatic downloading of non-free software by stuff in main Diane Trout <diane@ghic.org> - 2017-12-07 21:10 +0100
Re: Automatic downloading of non-free software by stuff in main Holger Levsen <holger@layer-acht.org> - 2017-12-07 14:00 +0100
Automatically marking downloaded files (was Re: Automatic downloading of non-free software by stuff in main) Anthony DeRobertis <anthony@derobert.net> - 2017-12-06 06:30 +0100
Re: Automatically marking downloaded files (was Re: Automatic downloading of non-free software by stuff in main) Stuart Prescott <stuart@debian.org> - 2017-12-07 02:40 +0100
Re: Automatically marking downloaded files (was Re: Automatic downloading of non-free software by stuff in main) Ian Jackson <ijackson@chiark.greenend.org.uk> - 2017-12-07 15:00 +0100
csiph-web