Coreboot Developer: Purism Doesn't Deliver On Libre Firmware

[MartinN]

Oh I dunno... maybe a higher end laptop with desktop linux as opposed to ChromeOS by default + coreboot.

seriously, besides Google's Pixel, who else makes a high end Chromebook? I know of none.

[peppercats]

Oh I dunno... maybe a higher end laptop with desktop linux as opposed to ChromeOS by default + coreboot.

a librem 15 with an HD screen and an SSD costs $2500.

A freetard and his money are soon parted, I guess.

I should really get into this business, start reselling 10 year old thinkpads for $500 because they're "free"*

[Luke_Wolf]

a librem 15 with an HD screen and an SSD costs $2500.

A freetard and his money are soon parted, I guess.

I should really get into this business, start reselling 10 year old thinkpads for $500 because they're "free"*

Meh, the thing is, people going "Well what does this offer that GluGlug and Google don't?" are being idiots, even if it's not something I'd ever buy, it's a good thing to have more Coreboot devices on the market, and turning your nose up just because it isn't pure enough for you when NEWSFLASH they're doing the best they can given they're working with Intel x86 hardware is disingenuous.

[zanny]

B: They're well written and not hiding bugs and security problems

Too bad you can never tell that, since its a blob.

The fundamental issue of firmware is that it is probably the software in your computer that can most easily completely abscond your privacy and ownership of the device all on its own. All ti takes is one firmware blob with kernel mode execution permissions to execute obfuscated instructions and magical operands on the chipset that cause it to behave errantly to your wishes, but you have no way to tell it does it, or what it even does, because all those aspects of the hardware are closed and proprietary.

And the worst part is, when you try to identify if and when these rogue blobs act against your wishes, you are almost certainly using another computer running its own blobs to do it. IE, when you use your router to monitor network traffic to try to identify if your motherboard is radioing home all the private keys generated by the hardware encryption ciphers, and you do not have both free firmware and free network drivers on top of a free kernel using free monitoring tools outputting to a free IO implementation (beep codes are probably the easiest to implement yourself in hardware, since every monitor has proprietary firmware) to even have a chance of accurately finding these exploits and backdoors.

It is a kind of irony that probably the most important software for personal computing freedom is the least free with the least choice, because while we are rapidly seeing the adoption of higher level free software across operating system level functionality, there is literally no way unless you are a billionaire to end up with free hard drive firmware, or freedom respecting discrete graphics cards, or standard motherboard packages with no blobs socketed with fully documented open processors.

[peppercats]

Meh, the thing is, people going "Well what does this offer that GluGlug and Google don't?" are being idiots, even if it's not something I'd ever buy, it's a good thing to have more Coreboot devices on the market, and turning your nose up just because it isn't pure enough for you when NEWSFLASH they're doing the best they can given they're working with Intel x86 hardware is disingenuous.

if apple sold macbooks with coreboot they'd still get ridiculed for being overpriced crap, yet everyone in the linux community is okay with a $2500 binary-blob laptop because it has "libre" in the name.

[pgeorgi]

B: They're well written and not hiding bugs and security problems

Let's just say that I binary patched (non-security related) bugs outs of coreboot related blobs before.

I'd expect security issues (if any) to exist in the ME firmware. Since it's unclear what those 1.5MB in the small version bring, it might already contain a network stack or an OpenSSL library that may or may not be up-to-date that are definitely part of the 5MB version.

C: Nothing major (feature wise) could be gained by an open rewrite

One major item is size: flash space is at a premium, and when doing some more advanced things, like stuffing Linux into there, every byte helps. Those binaries are in the hundreds of KB, while the open ivybridge reimplementation is much smaller. (It still requires the 1.5MB firmware for the management engine)

It feels weird to advertise size as a major feature, but it _really_ is for us.

[pgeorgi]

Meh, the thing is, people going "Well what does this offer that GluGlug and Google don't?" are being idiots, even if it's not something I'd ever buy, it's a good thing to have more Coreboot devices on the market, and turning your nose up just because it isn't pure enough for you when NEWSFLASH they're doing the best they can given they're working with Intel x86 hardware is disingenuous.

They're not doing the best they can when they start out either uninformed (not knowing what the limits in interaction with Intel are) or malicious (promising more than they plan to deliver in the end) - and never own up to that, but instead start publishing funny diagrams about how that binary stuff actually isn't all that bad. They started out with a different promise, and unless they make clear that they failed on that (instead of vague hand waving that looks like it's written to be misinterpreted by the public and media), that's the standard I expect from them.

A campaign "as free as Chromebooks, but more powerful and with the pristine Linux desktop experience" might have worked - or it might not. But that isn't the ticket they're riding on.

[nanonyme]

a librem 15 with an HD screen and an SSD costs $2500.

A freetard and his money are soon parted, I guess.

I should really get into this business, start reselling 10 year old thinkpads for $500 because they're "free"*

I'm pretty sure there's an actual market for 10 year old thinkpads assuming they're in decent condition. Maybe not for quite $500 but anyway

[pgeorgi]

Here's info on the Chromebook binary blobs from John Lewis's website: "No, in the case of Intel chipsets, there are at least 2 binaries blobs required ? the system agent and management engine binaries. Without the first, the system will not boot at all. Without the second your Chromebook will auto switch-off after 30 mins. The vast majority of coreboot compatible Intel hardware also requires a VGA blob."

Yes, and I fully expect both to still be around on Purism's hardware. They can't magically make them go away (or they'll face auto switch-off after 30 mins). There are actors (yes, plural) in the market with more money and clout than those guys who failed to persuade Intel.

Their own page on the firmware situation (https://puri.sm/posts/bios-freedom-status/) states: "But we still can?t see a way to disable the ME, there are people working on it but it?s a very very difficult problem to reverse engineer, because it uses RSA-2048 to secure it.". They also state "Fuse CPU to allow unsigned BIOS binaries [DONE!]" on the same page, which I suppose (given the complexity around the ME) means that they disabled Intel Boot Guard.

Good on them, but I think a statement like "While the BIOS is not yet free, the Librem 15 will be the first laptop ever manufactured to ship a modern Intel CPU fused to run unsigned BIOS code, allowing for a future where free software can replace the proprietary, digitally signed BIOS binaries" (https://www.crowdsupply.com/purism/librem-laptop) is again one of their misleading statements: the Dell Chromebook 11 also contains a Core i4 processor (and so would be Intel Boot Guard capable) - is that not "fused to run unsigned BIOS code"?

[stiiixy]

a librem 15 with an HD screen and an SSD costs $2500.

A freetard and his money are soon parted, I guess.

I should really get into this business, start reselling 10 year old thinkpads for $500 because they're "free"*

Maybe you should.

IBM Thinkpads (not Lenovo) were nothing short of great workhorses of a type you dont find these days without forking out thousands in a multiple. I worked with them daily, and was amazed at just how long they lasted running on 512MB of RAM with 5400RPM drives when basic software requirements were a full-blown desktop PC. Normally this would kill a laptop off in about 6-18 months. We had some 'technicians' drop all manner of IBM gear, but because of their build quality, could simply pick them up, dust them off, and shrug and move on. The fact they are quite possibly also the most open hardware still available? Well, why wouldn't you pay shit tonnes of cash for units like these? I know I miss the X-series for all manner of reasons.