Hacker News Reader

Comment by pingswept | Hacker News Reader

This appears to be similar to the open source hardware Novena laptop (https://www.crowdsupply.com/kosagi/novena-open-laptop), but closed source hardware.

From the Purism crowdfunding campaign: "The Librem 15 is the first high-end laptop where you are in control and have complete visibility into the kernel, the operating system, and all software."

It seems like the Novena came first and is substantially more free/open. A laptop running all open source software is still good, but it's not as pure as claimed.

View on HN

Novena has the bottom-up approach of Bunnie saying "oh here's a cool chip. I'll build something around it and see how complete it will be in the end."Purism seems to say "Let's make a machine that lives up to everyone's expectation, and let's try and remove all closed source blobs from it". They are going the top-down way of stripping an X86 machine from all its secret firmware.

I doubt they'll be as successful as Bunnie was with his approach when it comes to making a "clean" device with no dark and shady corners. (Or for that matter, even as clean as the Coreboot X60.) In turn, the Purism device feels a lot more desirable to me. Let's see if they can make it happen.

> They are going the top-down way of stripping an X86 machine from all its secret firmware.

Do they consider CPU microcode updates to be secret firmware?

I am not a CPU designer, so could someone explain the threat model of cpu microcode? Is it plausible that you could fit memory scraping code, including code that interacts with OS network drivers, all inside the cpu microcode without causing catastrophically impact on performance?

Sure. The TPM is connected via a bus, but there's no reason you couldn't build something like it into any other chip, including the CPU itself. http://en.wikipedia.org/wiki/Trusted_Platform_Module

You don't need to - all you need is code that says if you're processing data and you see this special sequence of bytes, start executing whatever follows it as kernel-level code.

This would be comparatively simple - you're just looking for a sequence of bytes and, if you see it, updating one or two registers.

Then you just need to get the special sequence followed by your exploit into the target's memory, which is trivial. Send them an e-mail, embed it in a picture of a cat and post it to reddit, stick it on the end of a gif in a banner ad, whatever.

If you check for the special sequence on the fast side of a fast/slow interface (like the interface between RAM and on-die cache) the speed impact would be all but invisible.

In addition to michaelt's comment, it's worth noting that security issues are only one of many reasons to prefer free software - at least in the opinion of the GNU crowd they are appealing to.

The CPU is fused to accept non-signed microcode so someone could eventually replace the microcode with a free alternative.

It's fused to accept a non-signed BIOS. Microcode is separate and, considering how tight-lipped Intel is about it, almost certainly won't be customizable in the foreseeable future. (Unfortunately.)

My feeling is that you are already executing CPU microcode on reset anyway.

It would be amazing if Novena or other projects like it evolved into something resembling Google's Project Ara, but for laptops instead of phones.

Laptops have unfortunately never really achieved the modularity and ease of modification that PCs have. They are seemingly perpetual slaves to cost, form factor and all the concerns that follow.

Panasonic rugged devices are modular, so it's technically feasible, even if the economics are not there yet.

ftp://ftp.panasonic.com/pub/panasonic/business/toughpad/downloads/Panasonic-Toughpad-FZ-M1-Configurations.pdf

The Novena is pretty good in that its schematics are entirely open source. It also has plenty of expansion headers, a FPGA, removable RAM and wifi cards. However, I don't think modularity is as important, because it's hard to make something modular, performant, AND low cost. If you have the sources, you can always make a customized version to suit your exact needs yourself, without the need for it to be modular.

(typing this from my Novena)

Project Ara seems like it might solve that problem itself. A laptop chassis which was just a GIANT Ara frame maybe?

Project Ara is going to be bigger than a regular mobile. It just has to have all those connecting hardware pieces.

Hopefully that turns out to be the case.

I have a feeling that modularizing (at least in Ara fashion) cutting-edge GPUs and x86 processors is no small feat. Never say never, but it seems unlikely that form factor could be maintained, let alone heat and interconnect requirements dealt with, when simply boxing up existing laptop or PC hardware.

It's likely that a lot of custom engineering and partnerships would be required beyond simply containerizing existing hardware. On the other hand, the trend toward things like on-die GPUs (and more) is promising, but at present you can't achieve truly top-end performance via this route.

The ideal then, I suppose, would be able to just easily snap together the equivalent of a few GTX 980Ms, sprinkle in a few i7s for good measure, and simply have it all work. Going on a trip and feel like packing light? Just take one of each, casually snap off the rest with little hassle.

Of course, if internet connectivity keeps improving at its current pace, application streaming may obviate the need for all of this, but who knows.

I would prefer to see Project Ara evolve into Novena. Google can keep their "NOT FOR SALE OR EXCHANGE" developer's agreement.

I'm interested if anyone has any insight into why there is a such a push for "Free" software (for example by the FSF, Richard Stallman), but not also "Free" hardware.

It probably has a lot to do with the difficulty of modifying existing hardware. (That is: people don't often think about modifying their hardware, so they simply don't pay much attention to its design.)

http://m.youtube.com/watch?v=eginMQBWII4

Free Network Foundation, https://thefnf.org

From RMS himself: http://www.linuxtoday.com/infrastructure/1999062200505NWLF

From the linked article: "Because copying hardware is so hard, the question of whether we're allowed to do it is not vitally important. I see no social imperative for free hardware designs like the imperative for free software. Freedom to copy software is an important right because it is easy now--any computer user can do it. Freedom to copy hardware is not as important, because copying hardware is hard to do. Present-day chip and board fabrication technology resembles the printing press. Copying hardware is as difficult as copying books was in the age of the printing press, or more so. So the ethical issue of copying hardware is more like the ethical issue of copying books 50 years ago, than like the issue of copying software today."

I'm a little surprised and disappointed by this answer. It seems like all four of Stallman's four essential freedoms of free software apply to hardware: to use as you wish, to study and modify, to distribute, and to distribute modifications [0]. Only the freedom to distribute is mitigated by the cost of copying hardware. The others all seem like an active battleground for end-user freedoms, and the freedom to distribute will be more important as both design tools and fabrication technologies become cheaper.

[0] https://www.gnu.org/philosophy/free-sw.html

There is a push for open source hardware, but it is a substantially smaller movement. The Open Source Hardware just formed a year or two ago: http://www.oshwa.org/ The movement is growing, but it appears to be around 15 years behind software, and maybe not growing as quickly as OSS did.

OSS branding dates to around 1998, ~17yrs old. The GNU Manifesto was published in 1983, the free software movement is ~32 years old.

True, but the GPL wasn't widely used until Linux took off in the mid-90's, roughly 20 years ago. So I was off by a few years, you're right.

(But I'd say the idea of free/libre software certainly predates even the GNU manifesto.)

What? When Linux was first released, the FSF had already written and released a ton of free software under the GPL, including Emacs (first release 1985), gcc (first release 1987), free versions of the unix command line utilities, etc.

I used the gnu utilites before linux existed.

I've been wondering about this myself. My guess is that the utility argument of open source has culturally occluded the freedom arguments of free software. There's a reason we call it open source hardware and not free hardware.

In the DIY electronics community, when someone suggests building an open/free professional tool (e.g. oscillscope, power supply, etc.), everyone responds "you're crazy, it would be too expensive, you'll never beat the cheap Chinese supplies (like Rigol) on price". Right next door, you'll see people who go to insane lengths to study and after-market hack the very same hardware. Hacks that would be both massively easier and more accessible if the hardware was open. (I'm thinking in particular of a thread on EEVBlog where a guy completely desoldered and resoldered (!) his Rigol oscilloscope to reverse engineer the front end.) I think the Novena is an awesome counter-example to this argument and I hope more people take on projects like this. (I would if I had the skillz.)

Reply on news.ycombinator.com