I understand that users need proprietary drivers to run certain
hardware, and Debian should not ignore this reality. That is why I am
not asking Debian to become a fully GNU-endorsed distro like Trisquel,
which rejects all non-free software in every case.
However, at the same time, Debian should not readily promote non-free >firmware to the point where it loses its philosophical distinction and >becomes just another convenience-focused distribution like Ubuntu or
Linux Mint.
After compromising a byte, our goal should be to find/develop libre >alternatives so that, in the future, Debian users are less (bit)
dependent on non-free firmware.
Instead, we did the
opposite--compromising more, from a byte to a kilobyte, for the sake
of convenience. If this trend continues, what stops us from reaching a >megabyte of compromise?
Debian's official inclusion of non-free firmware contradicts its
original philosophical values and social contract. Today, Debian
includes a few non-free firmwares; tomorrow, it may include several;
and the day after, many.
I urge Debian to rethink its decision to officially include non-free >firmware and correct the social contract.
Instead of making non-free
firmware the default, Debian should ensure that users consciously
choose to install it while being made aware of the implications.
GNU explains: https://www.gnu.org/philosophy/install-fest-devil.html
Imagine hiding the "devil" by making it an official part of Debian.
Debian is Debian--the "devil" should not be an official part of it.
The recent AMD Microcode vulnerability is a good case-study on the[...]
dangers of permitting non-free code to run on your CPU:
https://bughunters.google.com/blog/5424842357473280/zen-and-the-art-of-microcode-hacking
There is no way for me as a user to audit that the Debian
installer images is not including vulnerable microcode, since
source code for the firmware is not available.
pandya@disroot.org writes:
I urge Debian to rethink its decision to officially include non-free firmware and correct the social contract. Instead of making non-free firmware the default, Debian should ensure that users consciously
choose to install it while being made aware of the implications.
I agree and would personally come back to use Debian on some of my
laptops if there was a supported way to install Debian from official installer images that did not promote non-free software by including
firmware on them.
The recent AMD Microcode vulnerability is a good case-study on the
dangers of permitting non-free code to run on your CPU:
https://bughunters.google.com/blog/5424842357473280/zen-and-the-art-of-microcode-hacking
If you don't trust the vendor, then it makes no difference whether or not new >official firmware/microcode can be uploaded/flashed or not. If you don't trust >the vendor, then the initial microcode that came with your device might already
be doing things that go against your interests.
Of course we cannot have much confidence in a piece of microcode of which we do
not have the source code. But we also cannot have much confidence in a piece of
hardware with non-flashable firmware of which we don't have the vhdl/verilog >sources. So what is the difference?
Hi,
Quoting Simon Josefsson (2025-03-08 13:43:26)
My point was that there is no reasonable way to gain confidence about security properties of any piece of non-free microcode. Everyone can now produce AMD microcode that corrupts your machine in advanced ways that evade
detection, but we don't know if such malicious corruption is included in the
official microcode. Having source code for the microcode would help gain confidence in it, and is the reasonable request. If the request is denied, I
would consider the vendor not trustworthy and look into options.
I do not understand something about this argument.
If you don't trust the vendor, then it makes no difference whether or not new official firmware/microcode can be uploaded/flashed or not. If you don't trust
the vendor, then the initial microcode that came with your device might already
be doing things that go against your interests.
In the original GR, one of the options that lost was for Debian to host two sets of installer
images, one with non-free firmware and one without, and for users to be able to make an
informed decision before downloading the installer.
https://www.debian.org/vote/2022/vote_003#textc
This option did not prevail in the vote, but it would have been my preferred choice (I was
not a Debian Developer at the time and so did not vote, but I did follow the discussion).
Le Fri, Mar 07, 2025 at 11:42:10AM -0700, Soren Stoutner a écrit :
In the original GR, one of the options that lost was for Debian to host two sets of installer
images, one with non-free firmware and one without, and for users to be able to make an
informed decision before downloading the installer.
https://www.debian.org/vote/2022/vote_003#textc
This option did not prevail in the vote, but it would have been my preferred choice (I was
not a Debian Developer at the time and so did not vote, but I did follow the discussion).
True, but the GR does not prevent Debian of providing a second set of installer images. What is required is someone to do the work, as usual.
Cheers,
--
Bill. <ballombe@debian.org>
Imagine a large red swirl here.
Aurélien COUDERC <libre@coucouf.fr> writes:
Le 8 mars 2025 21:09:00 GMT+01:00, Simon Josefsson <simon@josefsson.org> a écrit :
I read this outcome as fairly clear message that, no, Debian does not >>want to provide a second set of installer images, and is not interested >>in contributions to make them.
What the GR says is that you cannot dump that work on the shoulders of
the people currently maintaining the installer, coordinating the releases…
I would be happy if my perception of the situation is wrong, and that
fully free official debian installer images was a welcome contribution.
Is that really the case?
Andy Cater's post is hard to parse for me. Andy, did you intend it as a sarcastic comment about something that has been beating to death too
many times already and has no chance of becoming reality? Or was it a
real invitation for discussion and accept contributions? My earlier interactions about this issue were stuck on a deal-breaker:
Andy Cater:
Please feel free to pick up the code and generate the second set of installer images, maintaining the code to exclude non-free-firmware.
If I understand what you imply here correctly, this is still a problem. Proper fully free images cannot be generated by going through an
intermediate step that involve non-free software.
/Simon
Another way to look at this outcome, and the one I personally prefer
by a wide margin, is that it'd be very cool to have them, but at this
time their utility is … questionable, given that I personally own zero
(out of umpteen) computers that would work with such an image.
Agreed. However none of that hardware require me to load non-free
firmware from my operating system, which is my point. That situation is sufficient for me to accept to use the hardware and install an operating system built without non-free software on it.
/Simon
Installing using the Debian installer doesn't *require* you to carry on
with the firmware. You can readily remove it - especially if you use the >expert install - you are not required to enable the repository in your >/etc/apt/sources.list and so on. The installer does list the firmware >suggested for install to enable all devices - you don't have to take
that suggestion.
Right, in the sense that they embed non-free software in the[...]
hardware.
None of those machines require them to be loaded by me as a user
for them to be useful to me.
This distinction is important to me.
For me there are several reasons for wanting this, which ought to[...]
be understandable for anyone reading this thread. The
supply-chain security trust concern of non-free firmware is a hot
topic right now.
My hope is that the sentiments
towards fully free installer images will change in the Debian project
and that they eventually may be official again.
If you don't trust the vendor, then it makes no difference whether or not new >>official firmware/microcode can be uploaded/flashed or not. If you don't trust
the vendor, then the initial microcode that came with your device might already
be doing things that go against your interests.
Of course we cannot have much confidence in a piece of microcode of which we do
not have the source code. But we also cannot have much confidence in a piece of
hardware with non-flashable firmware of which we don't have the vhdl/verilog >>sources. So what is the difference?
This is an old argument that didn't work for people holding this
opinion before and do I wouldn't expect it to work now. I don't expect
that people's opinions on this matter can be changed.
The current state where we have free software drivers for a lot of
hardware is the result of a lot of people investing a lot of time into >creating them.
In the same way, we need to do both: support our current users by
allowing them to use non-free firmware with their current hardware,
*and* push for new devices to have free firmware.
Part of that push is informing users that what we do wrt firmware is >best-effort, support for their hardware can be dropped at any point
and the free software community cannot put them in control of their >computing experience.
We're not obligated to validate their questionable choices in buying >hardware that ships with non-free firmware, or apologize for the bad >experience they have when upstream changes something they don't like.
It is not our duty as volunteers to compensate for the shortcomings of >companies, especially companies that use our volunteer time without >compensation -- we're the *free* software community, not the *gratis* >software community.
We've reached the point where people are shitting on nV for the
quality of their drivers, and a kernel that has closed-source drivers
loaded is "tainted", and the last release in which we shipped
ndiswrapper was buster.
Simon Richter <sjr@debian.org> writes:
their questionable choices in buying hardware that ships with non-free
firmware
Is there hardware that ships with free firmware? Seriously.
We're not obligated to validate their questionable choices in buying
hardware that ships with non-free firmware
We're not obligated to validate their questionable choices in buying hardware that ships with non-free firmware
There are a lot of competing priorities here, and it's the height of arrogance to be so certain that one's own opinion is best as to try to prevent other people from making their own decisions by hiding even the existence of a mechanism to install debian on their machine.
I still haven't heard arguments why people refuse to use an installer
that comes with non-free firmware, asks whether this firmware should
be used, and if answered "no", none of this non-free firmware ends up
in the installed system. The resulting system is free regardless
whether there was non-free firmware on the installation images.
https://www.gnu.org/distros/optionally-free-not-enough.html
https://www.gnu.org/philosophy/install-fest-devil.html
However if Debian dismiss those ideas, the argument that the fully free >installer doesn't exist because "nobody is working on this, go create
them and it will happen" does not seem valid to me. My reading is that
these images doesn't exist because Debian had a vote saying they should
not exist. I hope this will change in the future. Creating them won't >change the decision, but it may be input to renewed discussion.
I wonder if we get a reply from the OP or if this was just an attempt
to trigger a flame war. We will see...
To a certain degree, promoting official installer images without non-free firmware next to
installer images with non-free firmware can raise awareness of the problem. To another
degree, it probably wouldn’t do anything right now except confuse some subset of users
and require extra effort from those generating the images. Debian is simply too small of
an organization to make a very big splash by such a move.
As has already been mentioned, nothing of substance has changed since Debian held a GR
on this issue. However, if down the road open hardware with free firmware became more
widely available (I’m looking at you, RISC-V, although I understand that the most likely
short-term outcome is that companies will produce non-free firmware for their RISC-V
processors), then it might be worth reopening the issue for consideration.
| Sysop: | Keyop |
|---|---|
| Location: | Huddersfield, West Yorkshire, UK |
| Users: | 546 |
| Nodes: | 16 (2 / 14) |
| Uptime: | 145:56:29 |
| Calls: | 10,383 |
| Calls today: | 8 |
| Files: | 14,054 |
| D/L today: |
2 files (1,861K bytes) |
| Messages: | 6,417,687 |