Mitigations are attack surface, too • Hacker News Board

Re: Mitigations are attack surface, too

#21

Post by underlines » Mon, Feb 17, 2020, 3:53 AM UTC

pjmlp wrote: post #18

adrianN wrote: post #13

Earlier quoted context omitted.

To encourage people to either open source their drivers so that they can be maintained inside the kernel tree, or to pay the cost of updating their stuff themselves so that Linux kernel hackers don't have to pay for backwards compatibility.

It does wonders for those stuck with AMD cards on their laptops not supported by the open sourced driver.

if i understand the discussion correctly user space drivers could not help, right? and sadly, user space drivers in android are fairly limited.

https://developer.android.com/things/sdk/drivers

Re: Mitigations are attack surface, too

#22

Post by yzmtf2008 » Mon, Feb 17, 2020, 7:43 AM UTC

AnthonyMouse wrote: post #17

izacus wrote: post #9

Earlier quoted context omitted.

How would that work? Really? I mean, if you ever worked on any hardware, there's not many choices you have. Qualcomm says "no" and there's nothing much you can really do to get the same kind of software. It's also not interesting from financial perspective to do that. Incentives aren't there. This "oh, just force them!" mindset is incredibly naive and hasn't worked for desktop Linux in years. Madness here is trying t…

> This "oh, just force them!" mindset is incredibly naive and hasn't worked for desktop Linux in years. Are you kidding? There are open source drivers for nearly everything on the desktop. The biggest holdout is nVidia, and that's for the same reason as Qualcomm -- they have inadequate competition. There are people who need CUDA which allows nVidia to shove proprietary drivers down their throats. And even that's slow…

I don’t know about you, but if I were a big company evaluating vendors for my scientific computing / HPC cluster, whether or not a vendor has open source drivers would be pretty low on my priority list. If AMD comes out today with a CUDA competitor that people use with high adoption, companies will switch, and it won’t be because AMD’s drivers are open source.

Re: Mitigations are attack surface, too

#23

Post by oarsinsync » Mon, Feb 17, 2020, 8:57 AM UTC

izacus wrote: post #9

wtallis wrote: post #8

Earlier quoted context omitted.

If forced to choose between open-sourcing and upstreaming their drivers, or supporting them for 5+ years and forcing their customers to actually deliver those updates to end users, then Qualcomm absolutely would choose the open-source route. QC's taking the path of least resistance, but if we take "ship it and forget it" off the menu of choices, they'll change.

How would that work? Really? I mean, if you ever worked on any hardware, there's not many choices you have. Qualcomm says "no" and there's nothing much you can really do to get the same kind of software. It's also not interesting from financial perspective to do that. Incentives aren't there. This "oh, just force them!" mindset is incredibly naive and hasn't worked for desktop Linux in years. Madness here is trying t…

Comparative difference in value between desktop linux users (either individually or as a collective) vs Android mobile phone manufacturers is very different.

From the perspective of the hardware manufacturer, individual desktop linux users are worthless, and they're unable to form a large enough collective to have enough money to matter either.

Individual Android vendors may or may not be large enough to try and force the hand. Google requiring this as part of the Google Play contract, thus bringing a large number of Android manufacturers together, is a very different beast.

That said, there's still no way to know whether or not it would work, but comparing the collective phone manufacturers to desktop linux users doesn't really seem like a fair comparison.

Linux desktops remain a minority share. Linux mobiles account for the vast majority of smartphones in the world.