Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I Love Arch, but GNU Guix Is My New Distro

boilingsteam.com

Post reply on HN
Print view View original

181–190 of 318 posts

Re: I Love Arch, but GNU Guix Is My New Distro

#181

Post by marcodiego »

marcan_42 wrote: post #79
medo-bear wrote: post #75

Earlier quoted context omitted.

i just looked through this website and found a link to their certification process at https://ryf.fsf.org/about/criteria it states: > However, there is one exception for secondary embedded processors. The exception applies to software delivered inside auxiliary and low-level processors and FPGAs, within which software installation is not intended after the user obtains the product. This can include, for instance, mic…

The existence of that exception, the way it is implemented, the way they work with vendors to help them fit into it, and the way they do not require informing users of such secondary processors are all deceptive. Just look at the Librem 5. That CPU needs a blob to even boot (to train the RAM). Normally that would just be embedded into the bootloader. But that would make it evident in the build process for their boot…

Librem 5 is not RYF-certified.

Re: I Love Arch, but GNU Guix Is My New Distro

#182

Post by tptacek »

marcan_42 wrote: post #64
ckastner wrote: post #61

I guess that in their mind, they're producing code for some utopic x86 system that does not have non-open microcode baked in, in which case their approach would be right. This is a complete denial of reality, of course, and at the cost of the user. Religious dogma, as you put it, seems like an apt description.

Their approach is firmly stuck in the computing paradigm of the 70s and 80s, much like Stallman is personally stuck in the social narrative of the same era. The FSF and him refuse to change and adapt to the times. But since reality doesn't care about their refusal to adapt, and they can't just throw their hands up in the air and say nothing is free any more and you should just live off the grid and reject all technol…

This comment was strong until the last paragraph about the downvotes.

Re: I Love Arch, but GNU Guix Is My New Distro

#183

Post by medo-bear »

mindslight wrote: post #158
User23 wrote: post #138

Earlier quoted context omitted.

The FSF’s principles have always permitted the use of non-free software when it advances the goal of software freedom. GNU was initially built using non-free software. Given the pejorative yet inaccurate references to “religion.” I can’t help but think some people are deeply disturbed by the very concept of moral principles and and cognitive dissonance is forcing them to hallucinate that the FSF doesn’t actually have…

No, the argument is about the pragmatic criteria used to implement agreed upon principles. Bringing this back to concrete discussion, here is a quote from the Libreboot KGPE page: > AMD Opteron 6200 series (Fam15h, with full IOMMU support in libreboot - highly recommended - fast, and works well without microcode updates, including virtualization) > AMD Opteron 6300 series (Fam15h, with full IOMMU support in libreboot…

i am not affiliated with FSF in any way. yet it seems to me that there are plenty of people arguing against them in very bad faith. here is the full excerpt in question:

BEGIN

>CPUs supported:

>AMD Opteron 6100 series (Fam10h. No IOMMU support. Not recommended - old. View errata datasheet here: http://support.amd.com/TechDocs/41322_10h_Rev_Gd.pdf)

>AMD Opteron 6200 series (Fam15h, with full IOMMU support in libreboot - highly recommended - fast, and works well without microcode updates, including virtualization)

>AMD Opteron 6300 series (Fam15h, with full IOMMU support in libreboot. AVOID LIKE THE PLAGUE - virtualization is broken without microcode updates.

>NOTE: 6300 series CPUs have buggy microcode built-in, and libreboot recommends avoiding the updates. The 6200 series CPUs have more reliable microcode. Look at this errata datasheet: http://support.amd.com/TechDocs/48063_15h_Mod_00h-0Fh_Rev_Gu... (see Errata 734 - this is what kills the 6300 series)

END

source: https://libreboot.org/docs/hardware/kgpe-d16.html

the Errata 734 is quoted here as reference:

BEGIN

>734 Processor May Incorrectly Store VMCB Data

>Description: Under a highly specific and detailed set of internal timing conditions during a #VMEXIT for a virtual guest that has multiple virtual CPUs, the processor may store incorrect data to the virtual machine control (VMCB) reserved and guest save areas and may also store outside of the VMCB.

END

Re: I Love Arch, but GNU Guix Is My New Distro

#184

Post by marcan_42 »

arein3 wrote: post #159
marcan_42 wrote: post #27

> Guix System is an advanced distribution of the GNU operating system. It uses the Linux-libre kernel It's worth pointing out that the linux-libre kernel is developed under the FSF doctrine that "binary blobs are bad unless you can't see them". This has been taken to its logical extreme here, where this Linux fork actively removes security warnings informing users that they need to update their CPU microcode , becaus…

>FSF doctrine that "binary blobs are bad unless you can't see them" your statement is misleading why did you add "unless you can't see them" did FSF said binary blobs you can't see are not bad? Seems opposite from what FSF would do

The FSF openly endorses devices with hundreds of kilobytes of nonfree blobs burned into ROM. They do this because they claim they can just "say it's equivalent to hardware". They only care about blobs when they're loaded from software, because at that point their existence becomes apparent, even though naturally a blob loaded into RAM gives the user more freedom (e.g. to inspect it or change it) than a blob loaded from ROM.

Re: I Love Arch, but GNU Guix Is My New Distro

#185

Post by civodul »

marcan_42 wrote: post #27

> Guix System is an advanced distribution of the GNU operating system. It uses the Linux-libre kernel It's worth pointing out that the linux-libre kernel is developed under the FSF doctrine that "binary blobs are bad unless you can't see them". This has been taken to its logical extreme here, where this Linux fork actively removes security warnings informing users that they need to update their CPU microcode , becaus…

Guix is dedicated to ensuring user freedom. It doesn't provide non-free software so that users can make informed choices: they might choose to use third-party channels that provide non-free packages, or install non-free software via flatpak or some other tool, but they can trust Guix itself will never provide non-free software.

Part of allowing for informed choices is about raising awareness, for instance by explaining why some WiFi devices won't work out of the box (which is really the only practical issue one might stumble upon): https://guix.gnu.org/manual/en/html_node/Hardware-Considerat...

Re: I Love Arch, but GNU Guix Is My New Distro

#186

Post by pxc »

civodul wrote: post #178
pxc wrote: post #141

Earlier quoted context omitted.

I think Guix has like 1/3 the total number of packages available, probably less. This may not be a huge deal— when I started using NixOS, Nixpkgs was much smaller than it is now, too, but it still felt worth it for me. As another user pointed out, packaging in Nix and Guix is pretty easy for anything that doesn't have a bespoke or ill-behaved (requiring network access, trying to write to the directories of other pack…

"guix describe" and "guix time-machine" make it rather easy to pin a Guix revision (and thus the whole package set) and to restore it anytime: https://guix.gnu.org/manual/en/html_node/Replicating-Guix.ht...

I really like the design of `guix time-machine`. It's pretty cool how it just reuses the existing syntax for other subcommands, instead of modifying them.

Re: I Love Arch, but GNU Guix Is My New Distro

#187

Post by marcodiego »

marcan_42 wrote: post #180
ajvs wrote: post #86

Earlier quoted context omitted.

Just because some proprietary code exists doesn't mean you should leave the door open for them to add as much extra proprietary code as they wish. You can regard it as two separate features: one that's needed for the CPU to function, and another that's the door for more code being added. In that perspective it's better to go with preventing additions.

You can't add much to a CPU via microcode. The space of what updates can do is extremely limited, with a limited amount of patch RAM and patch registers. It's designed to fix bugs. You're arguing against fixing bugs in proprietary software you're already running.

So why don't CPU vendor open source their microcode? Secrets... ok, let's use the ones which have no secrets.

Re: I Love Arch, but GNU Guix Is My New Distro

#188

Post by medo-bear »

marcan_42 wrote: post #177
MichaelBurge wrote: post #128

Earlier quoted context omitted.

I'm not the FSF, but one argument could be things like the Intel Management Engine that I know the FSF have strong opinions on. If that's isolated to a separate CPU, it's easier to track the signals going in and out, and the bad things it can do are limited.

The FSF don't actually care about such details - sure, they'll deride ME, but they make no attempt to inform users about how it compares with alternatives and which options are better for users. That's because their criteria are not based on technical analysis, like determining what the access surface of the blobs is, but instead on the mere existence of the blobs. To them, all visible blobs are equally bad, regardle…

>To them, all visible blobs are equally bad, regardless of whether one can completely compromise your system and another one is completely harmless and requires no trust.

For a company that values software freedom above all else this is completely fine. If they are called Secure Software Foundation then your arguments would hold more weight. For example, I really doubt that FSF would claim that GNU Guix is more secure than Open BSD

Re: I Love Arch, but GNU Guix Is My New Distro

#189

Post by mbakke »

raverbashing wrote: post #174
mbakke wrote: post #164

Earlier quoted context omitted.

Guix will never prevent you from doing what you want with your hardware. Nor will it give you software that is not properly free (as in freedom). The "nonguix" channel mentioned in the article does have Intel and AMD microcode for users who want it. This is similar to Debian, where you have to opt-in by enabling the "nonfree" repository and "apt install" the microcode package corresponding to your CPU.

Good to know, but still > where this Linux fork actively removes security warnings informing users that they need to update their CPU microcode Is not ok

I believe that argument is based on the same FUD that I addressed here:

https://news.ycombinator.com/item?id=29290087

...at least, I don't see any such code in the actual deblobbing script: https://linux-libre.fsfla.org/pub/linux-libre/releases/5.15....

edit: since you called linux-libre a "fork", I feel compelled to point out that Linux-Libre is just the vanilla Linux kernel with that script applied. No more, no less.

Re: I Love Arch, but GNU Guix Is My New Distro

#190

Post by XMPPwocky »

anthk wrote: post #135
raverbashing wrote: post #103

Earlier quoted context omitted.

Yeah. Then these geniuses get bitten by Spectre/Meltdown because they were too scared of running the microcode update. For real. I agree, if that's the position of Guix, I don't want it in my machine.

Sorry, but you are wrong. GNU people won't run nonfree JS at all. LibreJS is a good example in order to kill any potential Spectre/Meltdown attack. There is no attack when no code is being run.

"LibreJS is a good example in order to kill any potential Spectre/Meltdown attack. There is no attack when no code is being run."

If attackers who cannot add a comment to their exploit are in your threat model.

Personally, I've been using a browser extension that blocks JS unless it has a comment reading

> This code is NOT evil or malicious!

at the top. Haven't been hacked yet!

Post reply on HN