Is Linux not free software itself? I thought propietary stuff was added downstream.
Am I getting something wrong?
A lot of drivers for hardware are actually not open source, just unreadable binaries that do …something. No one knows exactly how they work, so some people consider them a security risk.
I think its because the linux kernel is GPL2, not the modern GPL3 like most free software, so I think thats why some components are allowed to be non-free. Not sure though.
So, that practice violates the spririt of free software. So some distributions have those components removed. Its safer, but you may lose functionality, depending on what computer components you have.
Its an important project, and judging by the other comments here, underappreciated.
Could we please stop associating open source with security? Don’t get me wrong, I love open source software and it is easier to trust open source software than proprietary, because it is highly unlikely, that they hide stuff like trackers in there. It is also most of the time highly configurable and sometimes even hackable and as a software developer you are able to look into the mechanisms behind the APIs which is sometimes really helpful.
But events like the lzma incident last year and predictable openssl RNG in Debian some time ago (https://lists.debian.org/debian-security-announce/2008/msg00152.html) should tell us, that open source doesn’t mean secure software. And the argument, that there are many people looking at the code is not really true. E.g. many maintainers of the linux kernel only look at specific parts/drivers in it and maybe into some other things they need for that. There are probably only a few people if any (apart from governments), that have read, understood and analyzed the linux kernel in its entirety with all the (open source) drivers built into it and all the possible combinations of configurations. And I don’t want to know how many have done all that for less popular projects. And even if that is done at some point for an upstream project, you would have to check the patches from your distro and if there are any do it all for yourself again. And when the next release arrives you would have to do all that in its entirety again (although with some head start) if a new version arrives (that has, say, at least a thousand lines of code changed, removed or added). And now think about how many big releases come with some software per year. And don’t forget to also include all the dependencies you have to check including the compiler and standard library of the language(s) used.
Of course it is easier to do all that for OSS as an outside party because you don’t have to decompile it, but it is still increadibly hard. And only to be easier to analyze for security risks doesn’t mean to be more secure just like packaging being recyclable doesn’t mean that it will be recycled.
Well, to run with your analogy, I prefer things to be recyclable then to just throw them away.
I agree with you - to a point. The linux kernel is too big and complex to understand all of it as a single person. However, its critical software. Meaning, we are not depending on some nerd to find a bug anymore. There are companies that look through critical code to check for security issues.
Now imagine I made some somewhat popular open source server software that saved passwords in plaintext. Chances are good, that by sometime next week ill have someone on the internet scream at me for that. With proprietary software, no one is coming.
(Maybe at the next code review, someone will say something, but proprietary software does not imply me working at a corporation, and corporation does not imply the software having to be closed source)
Open source does not guarantee 100% secure software, but it does make obvious lapses in judgement much less likely. And sometimes, there IS a nerd who will look through the code because they wanted a feature, and finds a critical bug. Like the person that found the xz backdoor. The chance for that happening with closed source is zero.
I agree because it is exactly what my claim is. It would still be foolish to say that open source software is by design more secure than proprietary. I know that this is not what you said and you most likely also don’t mean that, but there are enough people who think that way because they read everywhere that OSS=secure software.
Your example with xz however does not really hold imo. The xz bug was not found because xz is open source but because someone realized, that their ssh session build up took longer than usual and they then used valgrind to check for issues and not because they looked in the source code. It wasn’t even really an easy to spot backdoor because it was a malicious compressed file that changed the build process while running the tests and injecting the actual backdoor in the compiled file. Therfore this would have been found with proprietary software with the same likelyhood.
And regarding my analogy: I also like it more when things are recyclable, that is also why I like open source software more and have more trust in it. But now that I think about it, that wasn’t the best analogy I could’ve chosen but it was the first thing that came to my mind.
This is why I like fediverse. Redditors would downvote this to oblivion.
Well, the majority still seems to be unhappy. I think it is mainly because I chose Linux as an example and it reads like I think that Linux is not secure software which is not at all what I intended to say and also (obviously?) not what I think is true.
I could understand that some distros’ kernel had binary blobs, but the main kernel?? I was not expecting that if it’s true.
BSD people laugh about linux because of that all the time
There were tons of comics by OpenBSD vs. Linux (being the corporate slave)
It really depends how you see the firmware boundary. You can either treat it as a set of magic numbers you load onto the hardware so it works or see it as an intrinsically programmable part of your system that you should be able to see the source code for or live without support for the device.
Concrete examples of such firmware: NVIDIA cards and nouveau. All of the kernel code is GPL, but you still need the firmware, which must be signed by NVIDIA and thus can’t be modified at all. Or some WiFi chip firmware.
Technically those could be permanently burned into a ROM chip on the device itself, but for convenience the vendor ships the firmware with the driver and load it at runtime so it always matches what the driver expects and save on a ROM chip. But now that means the driver is uploading a proprietary blob and being unable to provide your own is an artificial limitation imposed by the hardware. Sometimes such firmware artificially limits what the hardware can do, so the magic numbers can absolutely infringe on your freedom. Such firmware can also be the programming for an FPGA so it can get really complicated really fast. There’s also a legal aspect to it: FCC regulations on WiFi chips are typically enforced in firmware, so the manufacturer isn’t even allowed to let you modify it, but that’s also violating your right to tinker with your hardware and assume the liability. What if you’re not even in the US?
Some people would rather only have fully libre systems, but for most people a libre driver is better than a fully proprietary driver which is better than no driver at all and having to run a completely proprietary OS.
I think there are som non-free firmware stuff included in most distros.
Linux itself is Libre on its own, but its modular and anybody can add non-libre software/drivers to it. Android is a popular example to see what that means. But to be fair, I don’t understand why Linux-libre exist. These projects would remove proprietary software from Linux. It’s a script, so maybe its intended to be used with any Linux Kernel you have, that comes with proprietary blobs? In that case the project makes very much sense to me.
But as you I am not educated enough to understand all of this.
Edit: Found the script, so you can look at what it does to understand its purpose better: https://www.fsfla.org/svn/fsfla/software/linux-libre/scripts/deblob-6.9
https://wiki.hyperbola.info/doku.php?id=en:philosophy:incompatible_packages
I just want to know what did conky do to get in that list lol
They actually stopped using the linux kernel all together as well.
yeah well thats hyperbola, they are generally known to be extreme to the point of nonsense. If you want a good free-software only distro try guix. They apparently have the third largest software repo in existence. They have an unofficial non-free repo too.
Thanks, I’m actually building the libre kernel when you typed this.