libreboot vs canoeboot vs gnuboot

Hi Psion,

Although "disabled/neutralized" IME leaves as little as 84Kb in Gen2[1] of the original firmware (from 1.5 ~ 5 Mb depending on the model), there is still non-free Intel ME code running inside the computer. If someone removes this part, then the computer won't function.[2].

Although security and freedom are closely tied concepts, they are not identical. Let's say we say that a few Kb of code are acceptable. How many Kb is the limit?
We must invent an new category, i.e. "somewhat free", between free and non-free software. How does this help our movement or society to understand software freedom?
Treating the firmware as free or not free, based in the condition of it's ability to change or not[3], in my mind, has strong foundations in respecting my user rights and my freedom. At least until we find another alternative.

Returning to the subject of security, although 84Kb is not much, imagine what someone can do with a full privileged 84kb of code inside a computer system [4]. And this is way bigger (in code size) in next generations of IME.
Until today, I haven't found a complete security audit of the "disabled/neutralized" IME. Also please keep in mind, that in cybersecurity trusting something that you shouldn't is way worse than using something that you know that you shouldn't trust.
Of course I support the efforts of projects like coreboot and libreboot, but I believe that this is something that all users should know.

[1] https://media.ccc.de/v/34c3-8782-intel_me_myths_and_reality
[2] https://www.gnu.org/software/gnuboot/web/faq.html#Intelme
[3] https://www.gnu.org/philosophy/free-hardware-designs.html#boundary
[4] One example is "Silent Bob is Silent". More details at https://www.trendmicro.com/en_us/research/17/k/mitigating-cve-2017-5689-intel-management-engine-vulnerability.html

PS: I am not in anyway affiliate with FSF/GNU, other than supporting activities and theory of the free software movement.

> I still have yet to understand how any "freedom is lost"

If you own a CPU and that CPU has can run a Management Engine, shouldn't you have the possibility to setup a Management Engine that obeys you and only you, and that you can control and modify as you wish? In addition, these modern CPUs don't only run the IME, they run a lot of things that you have no control over, including DRM enforcement, which prevents you from using your own CPU as you want. Sure, you can still use a free OS, but with a CPU that has restriction made by software that prevents you from using all the physical capabilities of your CPU. Isn't that unfair?

> blobs that don't do any harm

As long as blobs are not entirely reverse engineered, there can not be any evidence that they don't do any harm. Removing them at least ensures that they will make no harm, but having them reverse engineered and modified freely would be much better from a freedom perspective.

> You won't gain any additional privacy or security by avoiding current libreboot.

For my machines supported by GNU boot, I intend to flash GNU boot because, when I asked about problems with Trisquel on libreboot/osboot, the maintainers clearly replied they did not care about it. Actually, they even made it clear that they think FSDG distros are wrong and people should use non-free firmware.

For machines that cannot be supported by GNU boot, no one says to avoid current libreboot. However, libreboot promotes itself as free software, omitting the fact that it must be installed with non-free software, so it is misleading people and I find the gain of libreboot vs. proprietary firmware rather unclear. People pretend the IME is disabled so it is fine, but there is no evidence that the remaining blob is harmless, and as time passes that remaining blob is bigger and bigger.

If you want to be safe, it may be a good idea to find a machine that runs without blobs.

"Can someone tell me what the specifics of where FSF/GNU and their supporters are coming from?"

Not from the privacy/security point of view as this is being framed. It's important to note that it's the "Free Software Foundation", not the "Privacy-Respecting Software Foundation" nor the "Secure Software Foundation." RMS didn't start this movement to make a replacement for UNIX because with the goal of enhancing privacy or security. I encourage you to listen to this piece and hear it from the person himself: https://jxself.org/better.ogg.

As you can hear from the recording, free software is based in ethics - in right and wrong, not in any other issue. About how proprietary software subjugates you. And so programs like GNU Boot are ethically superior just as he was talking about how GNU was ethically superior to UNIX. Not everyone globally subscribes to the belief that proprietary software is unethical. An example of that is the open source movement which doesn't talk about ethics at all but instead frames the issue about "higher quality, better reliability, greater flexibility, lower cost" - see https://opensource.org/about/ which is a completely different issue. However, if you're truly interested in grasping the perspective of the free software movement initiated by RMS, I urge you to delve into the ethical case RMS presents against proprietary software. About how it subjugates users. He covers it in many of his speeches. This ethical stance remains valid irrespective of any security issues or privacy invasions or other issues that software might also entail, and even if there are none.