LVFS Exploring Alternate, Open-Source Firmware For Capable End-Of-Life Devices

[oiaohm]

I am very interested. Do you have a list or a site with those?

I am not going to give a list. Mostly because its not a solid list. You have vendors be good with X product with end of life then due to change of management be horrible with Y then another change of management be good with product Z.

I do back right to repair. We do need a requirement for vendors in law to allow third parties to maintain things when they decide not to any more. I am not expecting companies to maintain stuff forever but they should not block people from maintaining the hardware long term either.

[oiaohm]

I meant "actually happening" from the perspective of people actually stepping up to support and maintain the alternative firmwares themselves, not from the perspective of it being an option in fwupd.

I do see it happening with particular hardware if the means are allowed.

https://www.cip-project.org/wp-content/uploads/sites/17/2018/10/CIP_Whitepaper_10.19.18.pdf

Its going to be items like Civil Infrastructure where they want 10-60 year lifespan on stuff so they don't have to do major re-certification stuff. Putting a few staff into maintaining firmware to run hardware to failure to save on certification in Civil Infrastructure will be cost effective. You are already seeing people from Civil infrastructure working on different coreboot solutions to update the firmware on old boards they are still using to remove like remote exploits in firmware.

Yes this is going to need vendor cooperation and user with a cost reason to spend the time. I do see this as going to be only select items end up with maintained third party firm-wares not everything.

[agd5f]

I do see it happening with particular hardware if the means are allowed.

https://www.cip-project.org/wp-content/uploads/sites/17/2018/10/CIP_Whitepaper_10.19.18.pdf

Its going to be items like Civil Infrastructure where they want 10-60 year lifespan on stuff so they don't have to do major re-certification stuff. Putting a few staff into maintaining firmware to run hardware to failure to save on certification in Civil Infrastructure will be cost effective. You are already seeing people from Civil infrastructure working on different coreboot solutions to update the firmware on old boards they are still using to remove like remote exploits in firmware.

Yes this is going to need vendor cooperation and user with a cost reason to spend the time. I do see this as going to be only select items end up with maintained third party firm-wares not everything.

Right. I can see this happening for properly funded projects with dedicated support (although at that point, the products are arguably not really EOLed) and perhaps on a few consumer level products with a particularly dedicated following, but I don't see this happening for general consumer level products even if they happen to have reasonable or even fully qualified coreboot support today.

[Paradigm Shifter]

If anything, this needs to be added to the Right to Repair talks. Unavailable to consumer proprietary parts, designed to fail and be replaced, etc is an issue that plagues everything from budget retailer bicycles to premium vehicle brands and everything in between.

<snip>

But you're right, they do have a lot invested in this. Just look at phones -- locked bootloaders and update schedules literally make them planned-for throwaway devices. Apple isn't any better. At least "unlocked bootloader" and "alternate operating system" can be official, supported things on Androids.

Frankly, this needs to gain a lot of traction from an ecological standpoint. Resources are finite. One time use and throwaway is just dumb and we deserve global warming and all the negatives of climate change. And a rant about yearly car models -- why the fuck do we need a new Camaro or Accord or Ram every year?

If I could give this more than one like, I would. For every paragraph.

The "designed to fail" thing seems to be a relatively modern occurrence - I remember my father had an old GE refrigerator; on 24/7/365 (as such things are, except when moving house) for 42 years before it finally suffered a failure he couldn't fix. And look at classic cars - while they might not be light, or efficient... I can't see a Tesla still running 50+ years after it rolls off the production line (or any modern car, frankly).

In all honesty, I think getting the eco-lobby completely immersed in this is the only way for it to take off. Of course, part of the trouble will be getting the hipsters (who say they care about the environment, but actions speak louder than words) to not want the latest toy every six months...

[oiaohm]

Right. I can see this happening for properly funded projects with dedicated support (although at that point, the products are arguably not really EOLed) and perhaps on a few consumer level products with a particularly dedicated following, but I don't see this happening for general consumer level products even if they happen to have reasonable or even fully qualified coreboot support today.

It really depends on the hardware where it used. You do find Civil Infrastructure using consumer space motherboards and cpus. Normally more your entry level motherboards by the way the ones that don't have fans on the chipsets. Some general consumer level bits of hardware will be support by the Civil Infrastructure side.

Quite a few of the boards that have fully qualified coreboot support has been done for the Civil Infrastructure usage to have open source firmware that can be more completely certified.

When you have a Civil Infrastructure project that going to use like 1000-10000 units of a particular motherboard and they want coreboot the vendor that wins the contract is the one that did not say no. Yes do you see this where you have two of the same motherboard one from Civil Infrastructure one from normal retail channel yes the Civil Infrastructure version has coreboot and the consumer retail version has vendor particular firmware and both are in fact vendor support firmware for that board. Yes more fancy GUI stuff on the retail board. These are normally cross flash-able as in covert from coreboot to vendor firmware and vendor firmware to coreboot. Of course the Civil Infrastructure coreboot is maintained longer than the vendor particular firmware on these boards.

Yes some of these boards from new putting coreboot on them don't not breach warranty because its vendor approved firmware. So I do question if this should be just end of life hardware. Maybe in LVFS we should be able to see if a motherboard is Civil Infrastructure coreboot supported and have the option to choose this even from day one.

Please note Civil Infrastructure is not the only big user of what we think of as consumer hardware that does invest in having more open source firmware for better validation and yes these parties use force of money to make vendor allow and approve their third party firmware. It more how to get these third party firmware to end users of course the vendors don't always list this on their website.

I am not expecting 100 percent of consumer hardware to be support this way. But what is already supported this way end users who are not big customers still should access to it for the best security with their old hardware when vendor decides not to maintain their own firmware any more at least Yes those running Civil Infrastructure and the like would still find it useful to have way of deploying their coreboot updates by LVFS.

[hughsie]

...people actually stepping up to support and maintain the alternative firmwares...

Then come to the meeting and find out! https://github.com/fwupd/fwupd/wiki/...ing-2022-01-28