> how can you tell the difference between a binary blob that is a large data table and a blob that is code that will be run on an embedded cpu?
Personally, I can't; I defer to lxoliva on that. He has a script that he runs against the kernel that has an accept whitelist for code that looks like a non-free blob, but is ok. See: