logoalt Hacker News

LegionMammal978today at 12:01 AM0 repliesview on HN

They do talk past each other a bit, and I find it difficult to follow, but overall, I'm more sympathetic to Garrett's position than Oliva's.

As far as I understand: GNU Linux-libre, a distribution, excludes the ability to update proprietary CPU microcode. Oliva, an important Linux-libre maintainer, says that (e.g.) Intel's proprietary microcode is inherently a backdoor, and that the ability to replace it only with new proprietary microcode is also a backdoor and an attack. Furthermore, new microcode updates cannot plausibly benefit the user and may only cause further harm to the user, thus Linux-libre (as distributed) makes efforts not to facilitate them.

Garrett is arguing against this notion, saying that microcode updates can very plausibly benefit the user in ways that cannot be mitigated in higher layers; that there have been no publicly-known cases of a microcode update introducing security vulnerabilities that were not already present; and thus, that it is beneficial to the user to have the ability (but not the requirement!) to update microcode blobs.

Both of them seem to agree it is better to have free software over proprietary blobs in all components of the system, though they both accuse each other of not fully standing for that position (Oliva accuses Garrett of "overlooking" the inherent backdoor nature of proprietary microcode; and Garrett takes issue with Olivia treating "installable software" as ethically distinct from firmware ROMs w.r.t. software freedom).

Personally, I'm not a fan of software or libraries that take active measures to make me use them in a certain way, so I'd lean toward Garrett's position, but thankfully no one is forcing me to use Linux-libre.