Discussion

discussion@lists.fsfe.org

1 participants
3272 discussions

OT: fcdev3b GSM modem board
by Paul van der Vlis 30 Oct '16

30 Oct '16

Hello, I would like some advertisement for the FreeCalypso development board: https://www.gofundme.com/fcdev3b-board-production-2umevjw Michaela is maybe a "bad hacker", and uses illegal methods and non-free software. But there is now a working open source GSM stack. Making voice calls and sending SMS-es is working on some hardware with open source firmware without blobs. Controlled using AT-commands. https://www.freecalypso.org/ People who want to make FOSS firmware can learn from the code. Creating a GSM stack without examples is very much work. The source code, documentation and the design files for the hardware are published. There is only 4500 USD needed for the production of 20 fully assembled boards, 25% is funded at the moment. Anonymous funding is possible so far I know. With regards, Paul van der Vlis. -- Paul van der Vlis Linux systeembeheer Groningen https://www.vandervlis.nl/

2 1

Uncorrectable freedom and security issues on x86 platforms
by Timothy Pearson 25 Oct '16

25 Oct '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 All, It has recently come to my attention that many in the free software movement are unaware of a relatively new development on x86 platforms that permanently removes the ability to use these platforms without also continually executing signed, proprietary code at the highest possible privilege level. All post-2013 (AMD) and virtually all post-2009 (Intel) systems contain this mandatory technology, and therefore, by design, can never be converted to run using pure FOSS. Prior to these changes projects such as coreboot could be used to replace the boot firmware with a FOSS alternative. The technologies in question are the Intel Management Engine (ME) and the AMD Platform Security Processor (PSP). Both serve effectively the same purpose; to ensure that the physical owner of the machine never has full control of said machine. These technologies, in turn, are used to implement various forms of remote control and Digital Rights Management (DRM) technologies, including Secure Boot, which even now requires FOSS users to purchase a license from Microsoft to boot FOSS on affected machines that lack an appropriate Secure Boot override. This includes, for example, many newer laptops. Major distributions have worked around this issue by purchasing a signing key from Microsoft for their binary packages, but the end user is unable to modify the signed software without a license from Microsoft, even though they have the source code available to them under the GPL. Furthermore, these signed, proprietary, binary-only firmware blobs must execute on the service processor(s) before the main x86 CPU cores are even released from reset (AMD), or will hard reset the entire system after around 30 minutes of non-operation (Intel). These blobs continue to operate on the service processor(s) as long as the system is powered on, and in the case of the Intel ME they also continue to operate while the system is powered off but still has access to power (e.g. plugged in or charged battery attached). These services processors have full access to system memory and all system peripherals, effectively giving the binary blobs executing on them a higher privilege level than even the operating system kernel. Due to the ability to access system peripherals, these proprietary blobs could easily contain code to exfiltrate encryption keys, remotely activate microphones and cameras, plant unwanted data, or simply remotely disable the ability of the machine to boot FOSS operating systems entirely. Finally, the Intel ME firmware can be forcibly updated by a remote entity; it is unknown whether the AMD PSP contains similar functionality at this time. So, what can an average user do? The obvious answer is to simply switch away from using the x86 architecture entirely. As Intel owns all rights to the x86 architecture, there will never be any new manufacturers licensed to make x86 chips, and therefore there will never be any competition to remove these DRM-laden antifeatures. There are numerous alternative architectures available, especially for those already using software with the source code available (i.e. FOSS), all of which can be licensed by other manufacturers should the need arise. ************************************************************************ General Overview of Alternate Architectures ************************************************************************ === ARM === While the ARM architecture may be more wildly known for locked-down computing products, there are several ARM devices on the market that allow full FOSS replacement of the boot firmware. Generally these are laptops, tablets, and embedded systems, with one example laptop being the ASUS C201 Chromebook: https://libreboot.org/docs/install/c201.html Using ARM in a mobile form factor also provides advantages of low cost and long battery life, albeit at the expense of overall system performance. === POWER === IBM has recently released their high-performance POWER8 architecture for third party licensing, and has also released a small treasure trove of firmware and documentation for these devices. POWER is the only architecture currently competitive with Intel in terms of raw performance, and boots using a fully FOSS firmware with no DRM antifeatures embedded. The primary disadvantage of power is cost, as it is currently targeted at the server and datacenter markets. We are attempting to bring POWER to the high-end workstation market in a FOSS-friendly form via the Talos™ Secure Workstation, but need additional interest to make this a reality: https://raptorengineeringinc.com/TALOS/prerelease.php === MIPS === Less well known than ARM, and with less vendor choice, MIPS is often overlooked. However, China has revived this architecture for general purpose computing with the Loongson core, and several machines are available using this processor. As a niche processor it has far worse performance than even a low-end ARM processor, but marginally better energy efficiency. Not recommended in light of ARM and POWER8: http://www.lemote.com/html/product/atx/2015/1227/8.html === RISCV === While this architecture is extremely limited in performance, price, and performance per watt compared to x86, ARM, or POWER, it is also one of the only fully open source CPU architectures available outside of an FPGA. and may eventually be competitive with MIPS in terms of raw performance. Currently there are no RISCV SoCs in production, however projects such as lowRISC aim to change that: http://www.lowrisc.org/ ************************************************************************ So, what are your thoughts on the current x86 proprietary software situation? Are you willing to continue to use FOSS software inside the ever-shrinking x86 "software jail", or are you possibly willing to give up some cost or performance advantages in order to retain full control of the software running on your hardware? This is a question that will need to be answered soon; the long-term consequences of a fully TiVo-ized computing world are not to be taken lightly, and thus far the free software community has put up very little resistance to the antifeatures being forced into modern x86 platforms. I hope to provoke wider discussion on these topics via this message. Thank you for your attention! - -- Timothy Pearson Raptor Engineering +1 (415) 727-8645 (direct line) +1 (512) 690-0200 (switchboard) http://www.raptorengineeringinc.com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iQEcBAEBAgAGBQJXAoLsAAoJEK+E3vEXDOFbstsH/0BrB1VLKuSDDPdV4C7qJQOc 5euFCVc3cjZJhl+oGHQ2LuSuDM6J9DuYRxJQq53Xx9WYrNMSuqNjcnaagIhew+Ci ocMEQNB3G7ob4+56kyYrOTL7YoqrFcqa9Y5rpBXBt5ufnYt/g3n1Zin7xQycJ/rP ldLeADsaTJpsRgWLBTDnOAmMGBh1Xv4d4w1ZYAgoNfGJD6nc7NhihajIMZRIgHIn /Uo2brToF6exizHFMGWLwYdEKLOkoau7Bmz5yaGKI0JJF7hzq/G9dpecKf42G1ra Fr9q07JHCre7JJrq6SlbjapJyDB+OOK+YoFDjTsxaikV8E20AIQG4VkS3DsL7rU= =47/v -----END PGP SIGNATURE-----

6 13

Call for Sessions at the FSFE assembly during 33C3
by Erik Albers 21 Oct '16

21 Oct '16

Hi all. as in previous years, the FSFE will organise an assembly during CCC including self-organised sessions. If you plan to go to 33C3 and you like to host a session, please read our call: http://blog.3rik.cc/2016/10/call-for-sessions-at-the-fsfe-assembly-during-3… Please also help spreading the call. Best, Erik -- No one shall ever be forced to use non-free software Erik Albers | Free Software Foundation Europe OpenPGP Key-ID: 0x8639DC81 on keys.gnupg.net

1 1

October Newsletter /Summit
by Werner Koch 14 Oct '16

14 Oct '16

Hi, reading the "FSFE Newsletter - October 2016" [1] We're still not over how cool it was to see so many from our community join the FSFE Summit in September. It was a good experience and we're keen to repeat it. [...] I miss any mentioning of an (internal) discussion in the aftermath of a very questionable talk[2] advertising proprietary software. The speaker of that talk is head of a company selling non-free software but trying to get associated with Free Software. In the F&Q after the talk the speaker was asked about this (35'50'' into the video) and confirmed that their software is and will not be published under a Free Software license. He also said that he did not think cloud services should at all require Free Software, be it GPL or BSD. I am quite surprised to see such a talk at an FSFE conference. In particular because the talk was not described as giving a counterpoint to Free Software. It was a straight ad talk and that should have been known to the program committee: For example, the FSFE president was recently guest at one of their dinner events and before that he had asked me about my opinion on that company (I once gave a keynote at one of their events). A newsletter should not be silent about topics which can at least be called controversial and have been called in as an agenda topic for tomorrow's FSFE general assembly. Shalom-Salam, Werner [1] https://fsfe.org/news/nl/nl-201610.en.html [2] https://conf.qtcon.org/en/qtcon/public/events/581 -- Die Gedanken sind frei. Ausnahmen regelt ein Bundesgesetz.

6 7

Gigablast OSS search engine
by Paul van der Vlis 19 Sep '16

19 Sep '16

Hello, I found an open source search engine, what looks-like useable: https://gigablast.com/ Strange that I've never heard of it before, it's OSS since 2013: http://www.prnewswire.com/news-releases/gigablast-now-an-open-source-search… When I search for the word "license" in the source code I find many different licenses like GPL2 or higher, LGPL, MIT, Apache, Lucent, OpenSSL, Eric Young. https://github.com/gigablast/open-source-search-engine/search?p=2&q=license… The search engine did not found all pages, but after adding them everything was found directly. http://www.gigablast.com/addurl And many sites are allready indexed. There is an advanced search with many possibilities: http://www.gigablast.com/adv.html Disadvantage: There is also a "commercial version" what seems to be faster, not sure about the license there. Not sure what I am using when I use the webinterface at Gigablast.com. Does somebody know someone who uses for sure the OSS version? Yes, I've heard about YaCy. But when I tested it, I found it not useable. e.g. here: http://5.45.105.16:18091/ more sites here: http://www.yacyweb.de/peers.htm Any comments? With regards, Paul van der Vlis. -- Paul van der Vlis Linux systeembeheer Groningen https://www.vandervlis.nl/

4 5

FSFE starts sale of older T-shirts
by Reinhard Müller 19 Sep '16

19 Sep '16

Dear friends of Free Software! We have just started to sell some T-shirt remnants for a reduced price of 10 Euro. So if you are interested in making a bargain while at the same time helping us to tidy up our merchandise stock, just have a look at https://fsfe.org/order/order.html and watch out for the red numbers. Have fun shopping :-) Regards, -- Reinhard Müller * Financial Officer * Free Software Foundation Europe *

1 0

[summit] Please share your feedback and pictures
by Erik Albers 16 Sep '16

16 Sep '16

Dear friends and Fellows of FSFE, the summit is over and so far from the feedback we received, it seems like participants enjoyed it and had a great time. Still, we are seeking for more input and if you have been to the summit, we are eager to hear your feedback! Please let us know what did you like and what not, what we should improve if we would do it for another time or anything else you would like to let us know. For the evaluation of our PR-activity it would also be interesting to know from where did you hear about the summit? You can give us feedback by sending an email to summit2016(a)fsfe.org or by writing into this etherpad: https://fsfe.titanpad.com/72 Also, we are preparing a page for everyone who could not have been with us at the summit. The page shall collect the video recordings of the talks and slides but also pictures of the venue, the speakers and the surrounding. Besides archiving this information for our community, the page might also he helpful this year in christmas fundraising. (many donors like visible activities and pictures) So, in case you made some pictures and videos of the summit, we would be really delighted if you share (some of) them with us. You can upload your pictures/videos here: https://web.3rik.cc/nextcloud9/index.php/s/TRizefznhSY2zpm You should be fine that if we choose your picture(s), they will be published CC-BY 4.0 or CC-BY-SA 4.0 or CC0. Means that if you have a preference, please let us know. Also, when you upload your pictures, do not forget to let us know who the author is! The easiest way to do so, would be to put your pictures in a container with your name as container-name. Best regards and thanks to everyone who made this event possible and who made it worth happening by participating. Best regards, Erik PS: please share this email with everyone you know who was at the summit but maybe is not on this list. -- No one shall ever be forced to use non-free software Erik Albers | Free Software Foundation Europe OpenPGP Key-ID: 0x8639DC81 on keys.gnupg.net

1 1

Is there a small hacker friendly firewall for home use?
by Miguel Tavares 08 Sep '16

08 Sep '16

Hi all, With everything wanting for some reason or another to connect to the internet I was wandering if anyone has some piece of advise on how to protect a home from data leaks. I was thinking of finding a device that would allow me to create a wifi network for this home devices (such as TV and what's not), monitor the connections created and have a white list of names and/or IP address that connections would be allowed. Thanks in advance, Miguel

6 10

page for the summit
by Cellini Bedi 05 Sep '16

05 Sep '16

Dear All, In the upcoming weeks we will set up a page for the summit that will show in back sight our talks, videos, pictures, press feedback etc. Done carefully, that page can be helpful for various things, among them PR activities and Christmas fundraising. For this, you will receive another email to give your feedback and to please send us your pictures, most probably at the end of the week. Today and with this email we only kindly ask you to help us in collecting whatever link that you have or have found in the internet about the summit in our pad: https://fsfe.titanpad.com/70 (which this time is public and editable for everyone : ) Best, Team Summit -- Imagine no European is any longer forced to use non-free Software! Save the date: September 2 - 4, 2016 - BCC Berlin, Germany Spread the word: https://fsfe.org/summit16#spread

1 0

system-hackers service agreement
by Daniel Pocock 28 Aug '16

28 Aug '16

Looking at the thread about the new blog team, it is clear that some things are dependent on the relationship that teams have with the system-hackers group Ignoring the current configuration of the systems, what is the ideal service that the system-hackers would like to be able to provide? E.g. - which OS/distribution? E.g. Debian - would more than one OS be feasible or required? (this multiplies support effort, should be avoided) - will services run in virtual machines and which technology will be used (KVM, XCP, Openstack, ...), e.g. will the blogging service run in a VM isolated from the services operated by other teams? - benefit: each team can receive major OS updates at different times - disadvantage: extra effort for system-hackers team, needs more IP addresses - how fast can packaged security updates (e.g. from Debian) be deployed? Will the updates be automatically deployed by cron or something, or will the team aim for a 24x7 support roster? In the latter case, are more volunteers needed in the system-hackers team? - how will major upgrades (e.g. from Debian 8.0 to 9.0) be deployed? E.g. aim to begin upgrade 3 months after the official release, individual teams using a particular server can veto the upgrade until 7 months have passed - which services must be supported by the system-hackers (I'd suggest backups, public web site, wiki, IP address allocation, SSL certificate creation, monitoring, Git, DNS, authentication/OpenID/LDAP, mail, mailing lists, SIP, XMPP and any services that the system-hackers may depend on in the course of their own activities) - are the system-hackers willing to support a database such as PostgreSQL for use by other teams? Can they provide a convenient way for members of other teams to take snapshots of their databases for use in test servers? - will the system-hackers allow members of other teams to use sudo? Maybe there are other things too, it would be good to see the system-hackers provide a list of what you would be willing to support and a separate list of what people think they need the system-hackers to support.

6 12

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

2001

2000

Discussion