Linux Foundation Welcomes LVFS Project (Linux.com)
The short-term goal was to get 95% of updatable consumer hardware supported. With the recent addition of HP that's now a realistic target, although you have to qualify the 95% with 'new consumer non-enterprise hardware sold this year' as quite a few vendors will only support hardware no older than a few years at most, and most still charge for firmware updates for enterprise hardware. My long-term goal is for the LVFS to be seen like a boring, critical part of infrastructure in Linux, much like you’d consider an NTP server for accurate time, or a PGP keyserver for trust. With the recent Spectre and Meltdown issues hitting the industry, firmware updates are no longer seen as something that just adds support for new hardware or fixes the occasional hardware issue. Now the EFI BIOS is a fully fledged operating system with networking capabilities, companies and government agencies are realizing that firmware updates are as important as kernel updates, and many are now writing in 'must support LVFS' as part of any purchasing policy."
Posted Mar 29, 2019 20:44 UTC (Fri)
by darwish (guest, #102479)
[Link] (2 responses)
It's really easy to misunderstand that part at first ;-)
Posted Mar 30, 2019 21:46 UTC (Sat)
by alison (subscriber, #63752)
[Link] (1 responses)
Posted Mar 31, 2019 15:50 UTC (Sun)
by mjw (subscriber, #16740)
[Link]
Posted Mar 31, 2019 1:21 UTC (Sun)
by pabs (subscriber, #43278)
[Link] (29 responses)
Posted Mar 31, 2019 1:32 UTC (Sun)
by intgr (subscriber, #39733)
[Link] (19 responses)
Unless you were expecting ordinary users to have to download compilers and specialized tools for all sorts of weird architectures and build the firmwares on their computer every time?
Posted Mar 31, 2019 4:09 UTC (Sun)
by pabs (subscriber, #43278)
[Link] (18 responses)
https://fwupd.org/lvfs/device/40338ceb-b966-4eae-adae-9c3...
Interestingly, LVFS are claiming that their distribution of the AltusMetrum ChaosKey firmware is proprietary and are not distributing any source code, but AltusMetrum themselves distribute the firmware under the GPL and provide source code.
https://fwupd.org/lvfs/device/b62500d7-c981-595b-a798-eb6...
Seems like LVFS might be violating the GPL here.
For open source firmware I'd expect something like Debian packages (automatically built from source using properly packaged open source tools) to be available, same as for any other binary I install.
Indeed, for the AltusMetrum case, altos and the ChaosKey firmware are available as proper packages from Debian and are even reproducibly buildable.
https://tracker.debian.org/pkg/altos
Another case of properly packaged open source firmware is ath9k_htc.fw:
https://github.com/qca/open-ath9k-htc-firmware/
Posted Mar 31, 2019 7:25 UTC (Sun)
by Wol (subscriber, #4433)
[Link] (2 responses)
Not if (a) Altus Metrum don't include 3rd-party code and (b) Altus Metrum explicitly provide the code to LVFS.
Not saying you're not right, but people are far to eager to jump to the conclusion "OMG!!! GPL violation!!!", even to the extent of claiming that people are violating the GPL *on their own code*, which any decent lawyer will tell you is an impossibility.
As I say, the obvious explanation is that Altus have put the code on LVFS and, absent any 3rd-party code, it's all legal and above board.
(Think of all the shenanigans on YouTube, where Marketing would upload videos, only for Legal to promptly demand they be taken down. Copyright - as implemented - is a badly mis-understood mess!)
Cheers,
Posted Mar 31, 2019 7:28 UTC (Sun)
by pabs (subscriber, #43278)
[Link] (1 responses)
Posted Mar 31, 2019 17:14 UTC (Sun)
by Wol (subscriber, #4433)
[Link]
Without that, you can't come to any conclusions whatsoever.
Cheers,
Posted Mar 31, 2019 12:28 UTC (Sun)
by intgr (subscriber, #39733)
[Link] (5 responses)
Posted Apr 2, 2019 16:27 UTC (Tue)
by hughsient (subscriber, #52199)
[Link] (4 responses)
Posted Apr 4, 2019 11:37 UTC (Thu)
by mgedmin (subscriber, #34497)
[Link] (3 responses)
Posted Apr 4, 2019 12:35 UTC (Thu)
by madscientist (subscriber, #16861)
[Link]
And in the spirit of other comments here hoping we can boost the profile of FOSS firmware vendors, it would be a nice bonus to them if there were a separate line in the table labelled "Source code" explicitly, with a link for vendors that provide it and "unavailable" for those that don't.
Posted Apr 5, 2019 15:22 UTC (Fri)
by hughsient (subscriber, #52199)
[Link] (1 responses)
Posted Apr 5, 2019 15:29 UTC (Fri)
by mgedmin (subscriber, #34497)
[Link]
Posted Apr 1, 2019 2:47 UTC (Mon)
by medicalwei (subscriber, #103028)
[Link] (4 responses)
Posted Apr 1, 2019 9:43 UTC (Mon)
by nim-nim (subscriber, #34454)
[Link] (3 responses)
It's so proprietary oriented, you have to proprietarize free software firmware to use it.
Posted Apr 1, 2019 11:06 UTC (Mon)
by pabs (subscriber, #43278)
[Link] (2 responses)
Posted Apr 1, 2019 16:15 UTC (Mon)
by nix (subscriber, #2304)
[Link]
Posted Apr 3, 2019 17:11 UTC (Wed)
by BenHutchings (subscriber, #37955)
[Link]
Posted Apr 1, 2019 19:46 UTC (Mon)
by Uraeus (guest, #33755)
[Link] (3 responses)
Posted Apr 1, 2019 20:58 UTC (Mon)
by Wol (subscriber, #4433)
[Link] (2 responses)
If as you say, provided the code is all owned by Altus Metrium, the GPL doesn't apply so it can't be violated. There is absolutely NO need whatsoever to comply with the GPL.
It is IMPOSSIBLE for the owner of the code to violate the licence - any licence. End of.
Cheers,
Posted Apr 1, 2019 21:01 UTC (Mon)
by Wol (subscriber, #4433)
[Link] (1 responses)
Cheers,
Posted Apr 3, 2019 0:08 UTC (Wed)
by xtifr (guest, #143)
[Link]
So LVFS must provide clear directions, and have taken on responsibility for ensuring that the source hosted by Altus Metrium remains available. But as long as they do that, I believe they should be fine--if the code is GPL3.
Posted Apr 2, 2019 12:40 UTC (Tue)
by ledow (guest, #11753)
[Link] (8 responses)
In software, we have succeeded to a vast extent, but it's still not quite the majority but people are beginning to see the benefits and most people are (often unwitting) users.
At this point, it's time to realise that people don't recognise the benefits, and the only way to make them recognise the benefits is to get them into the ecosystem and onboard with all the things they *could* do. How much easier would it be if vendors didn't have to make a BIOS for every machine, but could just use an already-written one? The option's been then for decades but almost nobody uses it. You basically can't buy a modern machine with Coreboot, they don't exist.
Rather than "fight the losing battle", we have to lead people half-way and then it's up to them to drink. Treating them as unwelcome visitors will just make them even more unlikely to touch our ideals.
And what better way than a vendor-approved firmware service that lets them standardise and be supported?
Myself, as a programmer, open-source lover, systems administrator, etc.... sorry, but if I can't buy products that are OS, and there are no OS equivalents, I have to use something. Pretty much people in my position cannot be fussy. I could not move my employer over to OS and all-free-firmware. We'd have to accept major compromises in terms of functionality and supported hardware (almost nil!). Even though my IBM servers are supported on Linux to a vast extent, there aren't free drivers for most of the main critical components, and firmwares are all proprietary.
We always complain about the apocryphal "Embrace, Extend, Extinguish" from the other side of the fence, but we don't embrace at all. It's almost impossible to convince such vendors to come 1% of the way towards us unless we're prepared to go 1% of the way towards them too.
As such a facility which *allows* proprietary firmware is necessary. Whether or not we use it that way. Nobody stopped git being used to develop closed-source code, or Linux to only run open-source binaries. There's a reason for that. It hurts us more to exclude them, than it hurts them to exclude us.
Nobody is saying that this facility will result in open-firmware. But if it didn't exist, closed-firmware would have to make its own way of doing so, which is a much worse situation.
It's time we opened up the evangelism to let people into our church - to see the benefits for themselves - rather than exclude them and have an isolated congregation.
Posted Apr 2, 2019 13:36 UTC (Tue)
by madscientist (subscriber, #16861)
[Link] (5 responses)
I haven't looked into LVFS, but if the comment made by pabs above is accurate:
> The design of LVFS is heavily biased toward proprietary firmware, as far as I can tell there
then this project isn't helping to lead either users or vendors towards free software.
Hopefully they will address this and provide simple and prominent ways to distribute source code (optional, of course!) and make efforts to reward those vendors that do so... maybe provide a list of them so that users who want to build or purchase FOSS-friendly hardware can check it, or offer special badges for different levels of FOSS support, or something.
Posted Apr 2, 2019 16:29 UTC (Tue)
by hughsient (subscriber, #52199)
[Link] (4 responses)
Posted Apr 2, 2019 21:30 UTC (Tue)
by madscientist (subscriber, #16861)
[Link] (2 responses)
To be clear I definitely appreciate the work LVFS is doing! I'm pushing devs at my company off of Macbooks and onto Dell laptops running GNU/Linux and the presence of LVFS to support firmware upgrades makes this transition that much simpler for everyone. Great stuff!
Posted Apr 2, 2019 22:07 UTC (Tue)
by andresfreund (subscriber, #69562)
[Link]
It has. Click on the license.
Posted Apr 3, 2019 11:12 UTC (Wed)
by hughsient (subscriber, #52199)
[Link]
Posted Apr 4, 2019 16:52 UTC (Thu)
by kpfleming (subscriber, #23250)
[Link]
Posted Apr 4, 2019 4:58 UTC (Thu)
by pabs (subscriber, #43278)
[Link]
Posted Apr 4, 2019 7:53 UTC (Thu)
by shiftee (subscriber, #110711)
[Link]
Isn't it used in ChromeBooks?
Linux Foundation Welcomes LVFS Project (Linux.com)
Linux Foundation Welcomes LVFS Project (Linux.com)
Linux Foundation Welcomes LVFS Project (Linux.com)
Linux Foundation Welcomes LVFS Project (Linux.com)
Linux Foundation Welcomes LVFS Project (Linux.com)
Linux Foundation Welcomes LVFS Project (Linux.com)
https://fwupd.org/lvfs/device/2082b5e0-7a64-478a-b1b2-e34...
https://fwupd.org/lvfs/device/84f40464-9272-4ef7-9399-cd9...
https://fwupd.org/lvfs/device/9c9871fe-75bd-5fde-9425-699...
https://altusmetrum.org/ChaosKey/
https://tests.reproducible-builds.org/debian/rb-pkg/unsta...
https://wireless.wiki.kernel.org/en/users/Drivers/ath9k_h...
https://tracker.debian.org/pkg/open-ath9k-htc-firmware
Linux Foundation Welcomes LVFS Project (Linux.com)
Wol
Linux Foundation Welcomes LVFS Project (Linux.com)
Linux Foundation Welcomes LVFS Project (Linux.com)
Wol
Linux Foundation Welcomes LVFS Project (Linux.com)
Linux Foundation Welcomes LVFS Project (Linux.com)
Linux Foundation Welcomes LVFS Project (Linux.com)
Linux Foundation Welcomes LVFS Project (Linux.com)
Linux Foundation Welcomes LVFS Project (Linux.com)
Linux Foundation Welcomes LVFS Project (Linux.com)
Linux Foundation Welcomes LVFS Project (Linux.com)
Linux Foundation Welcomes LVFS Project (Linux.com)
Linux Foundation Welcomes LVFS Project (Linux.com)
Linux Foundation Welcomes LVFS Project (Linux.com)
Linux Foundation Welcomes LVFS Project (Linux.com)
Linux Foundation Welcomes LVFS Project (Linux.com)
Linux Foundation Welcomes LVFS Project (Linux.com)
Wol
Linux Foundation Welcomes LVFS Project (Linux.com)
Wol
Linux Foundation Welcomes LVFS Project (Linux.com)
> "If the place to copy the object code is a network server, the Corresponding Source may be on a different server (operated by you or a third party) that supports equivalent copying facilities, provided you maintain clear directions next to the object code saying where to find the Corresponding Source. Regardless of what server hosts the Corresponding Source, you remain obligated to ensure that it is available for as long as needed to satisfy these requirements."
Linux Foundation Welcomes LVFS Project (Linux.com)
In firmware, we have almost nothing - unless you count devices specifically designed to run bog-standard Linux as firmware, even the RPi firmware isn't "open". Coreboot died. Phones don't even attempt to use such facilities, they are all proprietary bootloaders, driver firmware and system firmware.
In hardware, we have, again, succeeded but only to a tiny extent.
Linux Foundation Welcomes LVFS Project (Linux.com)
> is no mechanism for source code distribution, which is often required for open source
> firmware (which is usually GPLed) and should be done even if it is not required.
Linux Foundation Welcomes LVFS Project (Linux.com)
Linux Foundation Welcomes LVFS Project (Linux.com)
Linux Foundation Welcomes LVFS Project (Linux.com)
Linux Foundation Welcomes LVFS Project (Linux.com)
Linux Foundation Welcomes LVFS Project (Linux.com)
Linux Foundation Welcomes LVFS Project (Linux.com)
Linux Foundation Welcomes LVFS Project (Linux.com)
