A "Large Hardware Vendor" Wants A EULA Displayed For Firmware Updates On Linux

[phoron]

Um, no. You are aware that the GPL v2 and GPL v3 are also EULA's, correct? So are MIT, Apache, and all of the open-source license agreements. Literally every piece of every Linux distro is covered by one EULA or another. There is nothing inherently bad about EULA's.

Yes, and still we don't click through each of those licenses. We pick a distro with a know editorial line (like DFSG), apt install something, and a few hundreds packages may be installed without having to click in a few hundred licenses. Not even one for each different license. And when we want to know the particular EULA for a package, we look into /usr/share/doc/...

We can do that because the authors of those packages choose reasonable licenses, and the distro maintainers checked that they did.

In eclipse, for example, they are too tolerant with plugin licenses, and the installer will show you each license for each plugin and dependency. It's a pain. But at least it is for developers that more or less know what they're doing, and they might sometimes take extra care in ensuring compatible licensing.

All this vendor is asking for, is that the user be prompted to explicitly accept it. I don't have a problem with that, especially since you already have to explicitly accept their EULA to download the firmware from their web site today.

The problem is that the vendor is shoving it's problem away to others. Instead of picking a reasonable license so that distros can just distribute their firmware, they force people to download the firmware from somewhere else, then they force someone to accept the license. They don't even think of who should that be: the hardware owner (maybe a company) or the hardware user (maybe an employee). If the end user does not have the time to read the license or doesn't like it, then the firmware is not installed and the owner may have a misfunctioning or vulnerable machine. The IT crew has no way to ensure updated machines because the update decision is with the final user.

There won't be a solution until the users get together, stablish a set of reasonable clauses, refuse to buy from vendor that won't adhere to some subsets of them, and pre-screen EULAs *before* buying hardware. It is not reasonable to delay the EULA acceptance decision until the point you already own the hardware and need a firmware update. The vendor criteria could be that of free software or something else, but once one would come to it, in the end it would boil down as the free software definition as the most reasonable criteria, so the problem is already solved since the 80s. It's only that people don't want to know it.

That's why I never understood the whole story with LVFS. If the firmware is free, then it should come with the distro updates. If not it should not be used, precisely because proprietary software does not give enough rights to mutualise selection and maintenance like distros do. LVFS could have contributed something on the installation method or so, but for firmware selection, it all boils down to use reasonable licenses: therefore free firmware. Having free firmware it's only a pipe dream because consumers don't use their power. And it breaks down the moment a vendor insists that end users should really know what they're installing, because part of the point of LVFS was just hiding all that (assuming it would be reasonable, or the same conditions already accepted, or unenforceable, or whatever, but not decided at update time).

[doublez13]

hughsie Give us a hinnnnnnnnt :P

[useless]

Unlike other vendors, Samsung has a long time problem of not being able to update their SSD's on platforms that are not Windows. Fortunately they actually do not require any update.

Have you ever owned one of the EVO series? I had to update some two times: one was for the widely known performance degradation in the EVO 460 era (a couple of months of use and, basically, you then owned a slow regular hard drive) and the other more recent one was a firmware bug that could result in data corruption (I hit it). This was nasty, so nasty that Samsung deleted the support discussion thread (well, at least I couldn't access it anymore, nor is being listed in any search engine).

By the way: their firmware is known to cause issues with TRIM commands and queuing . There are some quirks in the kernel already.

[wswartzendruber]

Please don't be ASUS. I love you guys so much.

[om26er]

He should have asked that from his boss(es) inside RedHat. I do hope the poll was to get an "overall picture" of how people think and won't be used to base the decision on that. Toxic opinions, blocking progress is almost always what we get out of such polls ;-)

[silentcreek]

Luckily i live in germany where all EULAs are invalid anyway (maybe except B2B - not sure about that).

This statement is not correct. First of all, the main argument against EULA in Germany was that they can't be part of the purchase contract because the user usually sees the EULA after having purchased the software. With online sales, the vendor could solve this issue. The second problem is that EULA in Germany more or less have the status of "terms and conditions" nowadays which means that clauses that either disproportionately put the customer in an inferior position or clauses that are so unusual that no customer would expect them are invalid. Nevertheless they don't render the whole EULA invalid.

Now with firmware, I don't see how the whole argument that you didn't see the EULA before purchase would apply at all unless firmware upgrades are guaranteed in the purchasing contract. So, I'd assume a vendor could make you agree to the EULA in Germany for voluntary firmware upgrades.

Having said all that. I'm not a lawyer and this is no legal advice :P

[microcode]

He should have asked that from his boss(es) inside RedHat. I do hope the poll was to get an "overall picture" of how people think and won't be used to base the decision on that. Toxic opinions, blocking progress is almost always what we get out of such polls ;-)

Toxic opinions? Toxic to bootlicking and needless capitulation, or what?

[torsionbar28]

Yes, and still we don't click through each of those licenses. We pick a distro with a know editorial line (like DFSG), apt install something, and a few hundreds packages may be installed without having to click in a few hundred licenses. Not even one for each different license. And when we want to know the particular EULA for a package, we look into /usr/share/doc/...

Mountain from a mole hill. We're talking about a single "click" to accept one firmware package. This isn't exactly a burden to anyone, except you it sounds like.

[Danny3]

Um, no. You are aware that the GPL v2 and GPL v3 are also EULA's, correct? So are MIT, Apache, and all of the open-source license agreements. Literally every piece of every Linux distro is covered by one EULA or another. There is nothing inherently bad about EULA's.

All this vendor is asking for, is that the user be prompted to explicitly accept it. I don't have a problem with that, especially since you already have to explicitly accept their EULA to download the firmware from their web site today.

I have no problem with GPL V2 and V3, probably also with MIT and Apache, but closed source software have really awfull EULAs.
I still remember when I installed Windows 10 for testing in a VM and I has immediately horrified when I started reading their EULA.
I think with hardware can be even worse.
With this kind of crap I think in the future they will just force firmware requirements on webcams, mikes and network cards, the might come with EULA's similar to Windows 10, like the webcam having an option not to turn on the LED when it's on or the network adapter sending a copy of all the packets to some server.
So, with EULA's like this, you'll be forced to accept it or don't use the hardware.

You might be OK with accepting all kinds of agreements, but I'm not, since everyone, except the open source ones, restrict my rights and makes it harder to sue them when they go overboard with spyware or whatever the crap they wrote there for me to accept.

[ethana2]

I am going to guess that what's going on here is that nVidia is willing to let Nouveau use signed proprietary firmware with reclocking support but that it includes code from a third party that will only let this happen if the end user accepts the EULA.

Obviously I'm going to prefer AMD cards for Free Software reasons over nVidia ones, but imagine it-- Full performance Nouveau out of the box on Linux distros with just a EULA acceptance by the end user for the firmware. And to that I say, I'd rather use their firmware than their whole crappy driver for which I'd have to accept a EULA anyways.

So my vote is yes, even though I plan to buy AMD to avoid agreeing to the EULA in question.

Reducing the amount of proprietary binary code on a system is an improvement for security and auditability and if firmware runs on the card itself and not on the CPU like the driver, standardizing firmware delivery to allow other drivers to pull it is a huge win.

So really we should all think of it this way, I assert: What if this is how we get reclocking support in Noveau?