Intel Skylake & Broxton To Require Graphics Firmware Blobs

[schmidtbag]

Hiding the code will not make it more secure
In my opinion having more people looking at the code and design and trying to find problems with it definitely surpasses the risks

Like I said, being open source allows EVERYONE to look. That includes people who want to improve security as well as those who want to crack it.

Put it in this perspective - you have 2 identical programs with a security flaw. One is open source, one is closed source. For the sake of argument, let's say the number of users is roughly equal. Statistically, the open source program is going to get hacked first simply because the hacker gets to see directly how he/she is supposed to exploit the security flaw. But regardless of which program gets hacked, as long as they have a dedicated developer team, they will get fixed at roughly the same time. The open source program has the advantage of potentially thousands of users who can contribute, but the closed source program has the advantage of a trained and paid team - money is a powerful motivator to get things done in a timely manner. That specifically is why closed source is good. In an application with a dedicated developer team that only needs to focus on maintenance, closed source is usually predictable. That's why closed source GPU drivers don't usually matter. Closed GPU drivers get to be a problem when there are lacking features or poor performance.

could you tell me please what's the purpose o closed source software?

To reiterate, a paid, dedicated, and [ideally] predictable developer team is the primary advantage of closed source. I find your list of reasons a little ironic. You want something shared, for the community, but you're looking at software in a very selfish perspective. Sure, it's not cool to us linux users that something is closed source for anticompetitive reasons. But in the company's eyes, what they're hiding could be the very thing that give their product an edge. So if they lose that edge, they lose their marketshare, and therefore you as the consumer lose the product.

Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety. - Benjamin Franklin

Thanks for pointing that out - as I mentioned in an earlier post, if you're using Intel hardware and you want a fully free/libre system, you're being a hypocrite. Intel hardware is not open source. So where do you draw the line? You can't stop at software, because there are things that influence your security at the hardware level.
Furthermore, that quote is contradictory to your argument. You want the freedom FOR more security. But that quote says you can only have one or the other. I'd like to point out - you don't have to literally purchase the safety. These intel blobs are still free, but you would argue they're less secure.

[bridgman]

Why does DRM need closed-source blobs? IIUC this is similar to (and based on) encryption, where knowing the source doesn't matter as long as you have your private key, well, private.

It's the difference between DRM and security. Regular OS security is basically about the kernel implementing and enforcing the policies desired by the administrator, and it's generally accepted that an open source OS can do this (modulo the ongoing debate about whether open source or closed source is more robust).

DRM is different, in the sense that it's about implementing and enforcing policies which the administrator may not want, eg. restricting playback of video content to someone who has paid for it via an online transaction. In this case an open source DRM implementation is easy to "fix" while a closed source implementation is generally more robust.

The industry trend is to implement relatively more of the security AND drm-related bits in a dedicated security processor so that only those bits need to be closed source and the rest can be open, but that transition is just starting now.

[rdnetto]

Why does DRM need closed-source blobs? IIUC this is similar to (and based on) encryption, where knowing the source doesn't matter as long as you have your private key, well, private.

Because those closed-source blobs contain the private key. An open source DRM implementation is a non-starter, because then anyone could easily copy the key or disable the restrictions. Of course, the very idea that you can somehow give everyone a copy of your private key on their own hardware without giving them access to it is as stupid as it sounds.

[B.Jay]

Well, to add my two cents to the "teh 3vi1 firmware blobs"

Why is this even a problem? And allow me to elaborate...

Let us raise the first question by starting at the most common denominator (and let us ignore the "not exactly open source" aspect for a moment): Are you using your Windows desktop machine / Laptop / Tabet with just the generic Microsoft provided display driver (yes, I know they aren't open source, don't bunch up your panties girls) or do you use the Nvidia / ATI / Intel / <insert other manufacturer provided driver here> instead? I dare to bet odds are you installed the GeForce or Catalyst or Intel driver package to make full use of your graphics board, because otherwise none of your latest-and-greatest Steam games would run. Now ... where's the "teh 3vi1 binary blobs" ranting here? I never saw anyone complain about the fact that the drivers as well as the whole OS are "teh 3vi1 close-source demon" ... let alone see anyone bit** about the fact that they are running their stuff on hardware based on US Intellectual Property which could be backdoored by design as well.

Second question for even more brain-food: You happen to own a smartphone / phablet / tablet? Does it happen to run Android (or derivates thereof)? I'm sure you wiped the stock firmware off the device and replaced it with some other ROM that doesn't contain any of teh 3vi1 binary blobs so your WiFi, BlueTooth, GSM, UMTS, LTS, H/W Video and 3D acceleration and possibly even the touchpad doesn't work anymore - right? Wait.... you didn't? You're happily using CyanogenMod or OMNI or PAC or SOKP or ASOP (...) even along with gapps? And you complain about binary blobs because of why?

Third question (okay, more of a fact)... you really - honestly, frankly - use your Nvidia or ATI graphics card on Linux with Nouveau or one of the open source Radeon drivers? Congratulations ... your patience must be made out of Adamantium because if you read the one or another benchmark of open source drivers Michael posted here on Phoronix you may have found out that even the over-hyped Nouveau driver is a plain joke at best (maybe just good enough to qualify as a PoC (Proof-of-Concept)), Same applies to the opensource Radeon<whatever> ATI drivers, a mild joke at best. The open source "drivers" are merely good enough for setting up the "boot splash" via KMS (and more often than not they even fail at that biggest-time ... see the "black screen" or "oceans of colorful random pixels" syndrome). I have absolutely no problem using my graphics card with the proprietary driver to utilize the full potential and enable the full set of features (i.e. reclocking) ... plus ... I doubt my Titan X would even work with the Nouveau driver ... the GeForce GTX750Ti in my other box already has a hard time understanding what Nouveau wants to tell her.

Just because a certain unwashed cave troll abreviated as "RMS" runs a pointless campaign against everything closed-source doesn't mean he's right (as much as I respect and honor the man, he's plainly wrong at times). While I fully support the free software aspect I - as in _me_ - don't have a problem with closed source drivers or software on an otherwise open source operating system ... there are niches where you simply can't open source because of patents and intellectual property - a consideration even the kernel developers should slowly start to come to realize instead of showing ill manners by insulting major corporations (who don't really need to develop a Linux driver because, let us be honest, the market share is even below recognition) by flipping them the finger (yes, Linus was right that the "Bumblebee" thing was in an abyssmal state, but there would have been more polite ways to communicate the problem - hence why I don't really like Linus ... full of himself and manners like a wild sow).

That being said ... why are the binary blobs Intel wants to depend on in the future are problem again?


And just as a reminder: This is no flamebait or whatever, this are just my two cents on a topic which is entirely pointless to _ME_.

[horizonbrave]

Why is this even a problem?

because the more open source is in my system, the better.. just makes me feel better for literally hundreds of reason.
If companies that started opening their code change trend I would just plainly call it a regression.
I never had the luck to enjpy a fully open sourced android OS (derivative) on my phone so I'm not feeling like the situation is getting any worse (which is bad already, considering it's a linux system).. just to follow some of your "examples".
Discrete graphic card or not the matter doesn't change, whatever RMS the man says.
Your rant is far worse and more impolite then any flipping bird in my opinion.. and I don't get where your frustation comes from: not enough closed stuff into your linux box maybe?

[schmidtbag]

because the more open source is in my system, the better.. just makes me feel better for literally hundreds of reason.

Wow, what a compelling argument *sarcasm*. It's stuff like that why so many corporations don't take FOSS seriously. It's SOFTWARE, not a friggin brain implant. Oddly enough though, this "feeling" you get is all in your head. Basically what I'm hearing from you is that regardless of how well maintained an application is, you will always dislike it more simply because it is closed source. Sounds very religious to me, and I think we all know how religion has its affect on those who are blindly faithful.

So tell me - what would you honestly prefer? To get in a car with an ECU programmed by developers who work directly for the same team that engineered the car? Or, would you prefer to get in the same car but the ECU uses open source software developed by an unpaid community? Sure, the car might drive, but you don't KNOW if the airbags will deploy or if traction control decides to hit the brakes and lock them. Do you seriously think that the open source option is better in this situation?
A GPU is the same thing. It's way too complicated for a community to contribute to. Why do you think so many open source GPU projects (including hardware level) failed? I'll hand it to the nouveau devs, they're some seriously brilliant people. But even they can't unleash the true potential of something as old as an 8600 GT.

In another perspective - let's say intel did fully open source 100% everything of the GPU, including hardware level. Intel is STILL going to be the only contributor to the driver. So, even though it's open source, nobody is going to check what they could be doing to it. The driver could very well be scanning your system for personal data, something that you can readily view in the source code, but nobody will ever find out.

[weej]

I only have one question for them, Why?

[Gusar]

I only have one question for them, Why?

I'm not "them", but...

Because GPUs are complex beasts, and with this complexity comes the need to have some controlling logic on the device itself, it can't be all in the operating system. Because it makes sense to be able to update this controlling logic rather than burn in into ROM at fabrication time, for purposes of bug fixing and various kinds of enhancements.

Because this way people get to vent on forums, which wouldn't be possible if, for example, the exact same blobs got shipped with and uploaded from the EFI firmware, hidden and unknown to the user. Venting can be healthy, you know, stress release and such, so Intel is improving your health with this!

[duby229]

Wow, what a compelling argument *sarcasm*. It's stuff like that why so many corporations don't take FOSS seriously. It's SOFTWARE, not a friggin brain implant. Oddly enough though, this "feeling" you get is all in your head. Basically what I'm hearing from you is that regardless of how well maintained an application is, you will always dislike it more simply because it is closed source. Sounds very religious to me, and I think we all know how religion has its affect on those who are blindly faithful.

So tell me - what would you honestly prefer? To get in a car with an ECU programmed by developers who work directly for the same team that engineered the car? Or, would you prefer to get in the same car but the ECU uses open source software developed by an unpaid community? Sure, the car might drive, but you don't KNOW if the airbags will deploy or if traction control decides to hit the brakes and lock them. Do you seriously think that the open source option is better in this situation?
A GPU is the same thing. It's way too complicated for a community to contribute to. Why do you think so many open source GPU projects (including hardware level) failed? I'll hand it to the nouveau devs, they're some seriously brilliant people. But even they can't unleash the true potential of something as old as an 8600 GT.

In another perspective - let's say intel did fully open source 100% everything of the GPU, including hardware level. Intel is STILL going to be the only contributor to the driver. So, even though it's open source, nobody is going to check what they could be doing to it. The driver could very well be scanning your system for personal data, something that you can readily view in the source code, but nobody will ever find out.

There are a number of things said here that is entirely wrong.

First of all OSS devs deserve to get paid. Second no OSS community is entirely cut off from the product they are designing software for. I'd say the worst case scenario -is- nouveau. 3rd Intel -should- be paying their OSS devs, because like I said OSS deserve to get paid. 4rth even though Intel does pay their OSS devs and nobody else could have to worry about it, the code is auditible.

[dungeon]

I only have one question for them, Why?

Answer for that is simple, because we a users we are not allowed to watch what they are doing there.