Purism Librem 14 review (part 1): The ethical flagship
tuxphones.com
tuxphones.com
The Librem is probably the most available laptop with recent-gen hardware that is the most Free (i.e controllable down to the firmware through Free Software components, and sometimes puts proprietary components behind libre daughter cards). That's a laudable and an impressive achievement all by itself.
But when we say ethical, for me that would mean many other things too. Being very repairable and ideally modular so that the user can maintain the device for a long time. Selecting materials that ensure the device is very recyclable and sourcing those materials and the labour needed to assemble them from places that mine them in environmentally conscious ways, that don't employ child labour and pay workers fairly. Purism might be doing some or even all of that, but that information doesn't appear to be available from Purism itself and doesn't look like it's something TuxPhones intends to dig into.
Based on the next installments they do at least intend to look at the repairability of the device. Purism itself states:
> By removing just a few screws, you can easily replace the battery, wifi module, RAM, or the M.2 ssd.
They probably mean this: https://www.fsf.org/news/fsf-adds-pureos-to-list-of-endorsed....
See also: https://news.ycombinator.com/item?id=25504641.
It's repairable and upgradable, too: https://puri.sm/posts/beyond-right-to-repair/.
Possibly, yes. But if that's the case then I'd argue the author didn't understand the announcement. It covers PureOS the Debian-derivative published by Purism, not Purism's line of hardware. Purism does some stuff with hardware that the FSF considers "unethical", like the daughter card setup for components where they can't control the firmware.
The FSF explicitly states on that page:
> It is not a certification of any particular hardware shipping with PureOS.
No Purism hardware is "Respects Your Freedom" certified.
No, it's not just software. You can only run an FSF-endorsed distro, if you have no proprietary blobs in the OS. You can do this on Librem 14, because it uses Atheros (replaceable) WiFi module working with free software and firmware.
> No Purism hardware is "Respects Your Freedom" certified.
This is true, but they are trying to get this certification for their Librem Key and Librem 5.
There are already many FSF-approved Linux distributions which you can install on most laptops, many of which existed before PureOS.
But your WiFi card will not work on those laptops, except for Lenovo ones from 2008 and earlier.
Well, they didn't say "no animals were harmed in the making of this laptop" so I'm going to assume that's not what they meant & therefore probably slaughtered countless puppies in the process.
The author has confused two things here, which are not related. The ME is not microcode, it is a special processor inside the PCH, and is supposed to provide remote management services. Whereas the Intel microcode is a totally different thing - it is an updatable part of the main CPU itself and is used for fixing performance issues, errata, or security issues like Spectre.
Just one referred to as Intel Microcode™ which is what they want you to think of as microcode, and the other _also_ being code that executes within the chip outside the user's view, which Intel doesn't refer to as Intel Microcode™ but which still meets the dictionary definition thereof?
(I am waiting for my Librem 5 too by the way!)
Edit: Their estimate for the new orders comes from the information from the CPU suppliers, which say the same thing. Every time they can get the CPUs, they ship another bunch of phones. See also: https://forums.puri.sm/t/estimate-your-librem-5-shipping/112....
This is true, and they had good reasons for that in my opinion: https://source.puri.sm/Librem5/community-wiki/-/wikis/Freque....
> At one point they even lied to be shipping devices
Yes, it did happen: https://source.puri.sm/Librem5/community-wiki/-/wikis/Freque....
No, that would be the i7-10870H, which has a higher base & max frequency, and on high performance settings will support sustained workloads much better before throttling down. Intel's "U" chips are one of the the low power flavors. Not horrible for very short burst but pretty bad for sustained loads.
I'm using the equivalent H from Gen 9. Work initially "upgraded" me from a 8+ year old xeon to a Gen 9 i7 "U" processor, and it was like stepping into molasses so I insisted on the H. Battery life is significantly worse but I can actually get work done on it, and switch to low power mode if I need to stretch things. (Even then it doesn't last as long as a U, but it's a good compromise for me)
Definitely not the sort of chip you'd want to do anything besides text editing and video streaming on though.
[1] - https://www.dell.com/community/XPS/XPS-13-9310-Ubuntu-deep-s...
My XPS 13 has hardly ever been off since I bought it (2018 model), I enabled sleep/hibernate with a tweak, and it'll last weeks just sitting there "sleeping" if I don't use it.
Their phones run desktop GNU/Linux. Their security is then the same. It's probably not enough for a phone, if you run a lot of untrusted apps, but it's a start. Also, the app store only consists of FLOSS apps.
See also: https://source.puri.sm/Librem5/community-wiki/-/wikis/Freque....
It's a valid concern: On the one hand Purism is gradually achieving their intermediate ideal of providing machines with open firmware for all the hardware; On the other hand, if the real life security of that open firmware is poor, it undermines their underlying principle of privacy - To complicate matters it may not be technically worse than the proprietary blobs it replaced, but it's open for all to see.
In other words, to achieve real world privacy, it's not enough for the firmware to be open, it must also be secure.
It's the same thing you should be doing on the desktop if you fear untrusted USB devices.
It's better to not expose the needless attack surface rather than just attempting to isolate the attack into a leaky VM.
What is the alternative? If you don’t use a VM you have to expose dom0 directly to device io.
EDIT: ah I see we’re talking about a Linux phone! I agree with your point I’m not sure mobile devices have the resources to isolate every component into a VM. Overkill indeed!
I’ve looked a few times for an ARM SBC with a nice architecture to play with this stuff, Nvidia seemed to be the only option but they are also unobtanium right now.
And the pointless supply chain vulnerability, introduced in order to game the FSF certification process, and lying about security features in their competitors, and accusing them of using binary blobs which they actually do as well while doing so with a worse security implementation.
>you can fix that quite easily with a bunch of udev rules, I guess
Exactly, why didn't they? I would understand if some of those were just teething troubles but that phone came out well over a year ago and bear in mind this analysis and criticism comes from within the OSS community trying to help them get this fixed, and hitting a brick wall.
Here's another example of this with them bashing Android/iOS security:
> One of the problems with the security measures implemented in Android and iOS is that they restrict the user as much, if not more, than they restrict an attacker. [1]
When Android actually has pretty decent sandboxing [2] which I've never felt restricted me as a user, and can actually protect you from malware, unlike their recommendation which is just security theater without a sandbox when it comes to malware.
Unless you don't plan on ever installing any apps and personally audit every update yourself (since it's unlikely someone else will audit every single one thoroughly enough), malware and malicious third parties are a much greater threat than Google who is actually pretty transparent about what data they collect and handle it securely and responsibly.
[1] https://puri.sm/posts/snitching-on-phones-that-snitch-on-you...
Congrats on not hitting it, I guess? Android is absolutely painful if you try to do anything interesting, and it's becoming annoying even for trivial stuff - it was annoying but understandable when they started killing API surface for tasker and termux to use, it was annoying but understandable when they almost broke termux outright, but it moved beyond being understandable when they restricted file access so much that a third-party app can't move files between directories without the OS prompting you to allow the "delete".
What use case do you have where you have an app that you want to be able to move files but you don't trust it with the "delete" permission?
And yes, it may be a localized bug, but it's a localized bug that wouldn't occur on a nice normal GNU/Linux desktop without all of this, bringing us back to me agreeing with
>> One of the problems with the security measures implemented in Android and iOS is that they restrict the user as much, if not more, than they restrict an attacker.
This is compared to PureOS where you may have free reign, but so would an attacker if you install their app on your device. If you used QubesOS I'd argue that restricts the user a similar amount as Android does, not to mention missing out on a number of mobile friendly apps.
I don't have fixed standard ports, but I do have 4 full thunderbolt 4 ports, supporting power/charging on all, and displayport on all, and the modules convert those into whatever combination of dongle-less ports I want. Even though I would like a dongleless ethernet and there is no module for that yet, I still feel like I have way better io than this because what I do have is configurable and way more powerful.
Framework's special aim is more about hardware freedom and reusability/repairability, but software freedom is a very close second and they are not exactly slouching on that job.
Of course the machine is fully supported under linux for all hardware, and beyond that, they have fwupd support in beta, and most impressively they open sourced the bios a few months ago.
Between the open source bios and the ability to install whatever wifi card and storage you want, and the ability to disable the management engine in the cpu yourself by a hack essentially, you get pretty close to eradicating all the blobs.
And it's cheaper, even more repairable, and has better io (in a sense).
It has hardware camera & mic kills but not hardware rf kill. The screen is 3:2.
I routinely run 2 portable external thunderbolt/dp displays. Single usbc/tb3 cable to each display, power and data.
I'm not a gamer but other people have used external gpus on it so the ports support that.
I also routinely use a tb3 dock on my desktop for gigabit and two monitors and power on a single cable.
The plugin modules also means that the usbc ports are also all essentially prophylactic. If you break a usbc port, all you really broke is a $9 passthrough module which you can replace in 2 seconds like swapping a thumb drive. You can even keep using the real usbc port while the replacement module ships, if you didn't already have a spare.
64g removable ddr4, 2t removable nvme, 11th gen i9. I don't suffer for power.
Battery life could be better. After tuning I get 6 or 7 hours. Not really up to par for today, although my machine is maxxed out in cpu, disk, and ram which is on me. There is a known issue that some of the plugin usbc modules draw power at all times even when not in use and even when the machine is powered off. So, I happen to use a thunderbolt dock on my desk, and my portable monitors are usbc, so I don't happen to ever actually use the hdmi or dp modules I got, so I don't happen to suffer that power drain because the usbc modules have no electronics.
I'd be interested in hearing more about the touchpad and keyboard. The Framework keyboard feels fine and is backlit, but I don't love the layout. And I really don't like the apple-style huge glass touchpad with no buttons. At least the pad is clickable so I can at least still disable taps. And at least it does work well when I must use it. Mostly I use an mx keys keyboard and mx anywhere 3 mouse.
I really like the keyboard and touchpad on my x1 carbon 5th gen (2017/2018).
I love the company’s mission, so I’ll cut them some slack on v1 but it feels dishonest. They should really iron out all their problems with BIOS, audio jack, suspend/hibernation, grub before selling the idea that fedora 35 is fully functional. Just be honest!
EDIT: I’m looking for a reasonable dock/KVM switch lmk if you have any recommendations!
might be worth the effort of testing other distros (i hear arch has the bleeding edge)
The suspend thing I think has to do with the bios not linux. It's a bug but not a linux support bug, I think.
I'm currently using a fairly old HP tb3 dock that was really only intended for use with a few laptops of theirs. I like it for it's form factor, and it does function, but there are a couple annoyances that have me looking for an update.
The tb3 cord is removable but so special that it might as well be hardwired. The dock end has a big plug with both a usbc and barrel connectors in one big chonk. The usbc part is normal so you could replace that cable with another, but you'd lose power delivery.
The video outs seem to be a bit marginal. They work but they seem to be easily disturbed, like they are right on the edge of not working. The screens lose sync and reconnect once in a while. Once in a while is not multiple times per day, but probably at least a once or twice most weeks, but also some multiple weeks with no glitch. My magnetic usbc adapter surely contributes.
Somewhere between half the time and all the time, the external monitors do not wake when the laptop wakes from sleep, and by sleep I mean just the first level like just blanking the screens. I don't have any swap or hibernate configured. But all I have to do to restore both screens is just rock the magnetic usbc connector 90 degrees to break the connection, wait 2 seconds or so, and let it snap back, and both monitors come back on and the xubuntu xrandr tool automatically restores the profile that uses them positioned the way I had them.
If I'm lucky, maybe even most of my ssh sessions survive the temporary loss of ethernet. oh-well-emoji haha
I got the same model of dock for my gf and she has a lg gram and only one external minitor, and she's running windows, and her monitor loses connection all by itself even when not idle/blanked, sometimes multiple times in a day, sometimes a couple weeks with no problem.
I have gone through a few different attempts at getting new higher quality cables and shorter runs etc.
So I think the display flakiness is in the docks and not in the laptops or the OS's or the monitors.
But it is suuuuch a sweet little unit, and it does work so 99% well. Everything else are these big ugly boxes that are big enough that they might as well just be mini pc's and skip the laptop. Or they are nice looking small but junk guts.
HP Elite ZBook TB3 dock 1DT93AA#ABA