61–67 of 67 posts
I looked into fwupd once... it sounds nice to be able to update through a central service, but then it devolved into a rabbit hole of turning on all the privacy bugs I had previously disabled on my laptop. Why any of that is part of a firmware updater, I don't know.
What does that mean? We've got a very comprehensive privacy policy... https://lvfs.readthedocs.io/en/latest/privacy.html
Earlier quoted context omitted.
On the bright side, you can finally mask it in latest Fedora without Software store going haywire and spamming you with useless error messages about it being unavailable. Still waiting for that to arrive in next Debian… I’m sure it’s useful to Dell users, but not much to anyone with DIY setups.
> Still waiting for that to arrive in next Debian… This is the second comment I've noticed "waiting for it to hit Debian" and I don't understand. hbarta@olive:~$ apt-cache policy fwupd fwupd: Installed: 1.5.7-4 Candidate: 1.5.7-4 Version table: \*\* 1.5.7-4 500 500 http://deb.debian.org/debian bullseye/main amd64 Packages 100 /var/lib/dpkg/status hbarta@olive:~$ It's even on Raspberry Pi OS and I wonder if it serves…
I’m waiting for fixes to Software center, so that there are no visible side effects after masking fwupd. I do know this was addressed in or before Fedora 37, but is an issue in current Debian stable.
The only time I saw fwupd itself working is when it attempted to update uefi firmware in my VM :)
I looked into fwupd once... it sounds nice to be able to update through a central service, but then it devolved into a rabbit hole of turning on all the privacy bugs I had previously disabled on my laptop. Why any of that is part of a firmware updater, I don't know.
> it devolved into a rabbit hole of turning on all the privacy bugs What does that mean? We've got a very comprehensive privacy policy... https://lvfs.readthedocs.io/en/latest/privacy.html
Earlier quoted context omitted.
> it devolved into a rabbit hole of turning on all the privacy bugs What does that mean? We've got a very comprehensive privacy policy... https://lvfs.readthedocs.io/en/latest/privacy.html
I mean all of this junk (not my screenshot - my laptop is much worse) https://blogs.gnome.org/hughsie/files/2020/10/Screenshot-fro...
Earlier quoted context omitted.
I mean all of this junk (not my screenshot - my laptop is much worse) https://blogs.gnome.org/hughsie/files/2020/10/Screenshot-fro...
You're going to have to be more specific on why a failing HSI attribute contributes to the undoing of your privacy? You're aware the security attributes are each based on mitigating actual real-world attacks, right?
Edit: again, why is this any part of a firmware updater?
Edit2: this doesn't even get into unsigned kernels, out of tree modules, and unencrypted swaps (or at least not encrypted in the special way fwupd wants them to be)
Earlier quoted context omitted.
Good to know. Why is it a root daemon and not a command/library if other tools are directing it? If I had to guess, so the end user does not have to elevate to superuser to initiate actions?
Yes, mostly that. Depending on local policy, it might be possible to upgrade [only] signed firmware from the correct vendor without authenticating. Downgrade always requires authentication for obvious reasons. Most firmware requires you to be root (some even CAP_SYS_ADMIN) to just enumerate the hardware and read the firmware version. The other main reasons is that some hardware is really, really slow (like 8 seconds…
(Thought I'd seen a GUI for firmware but can't find it at the moment.)
Earlier quoted context omitted.
You're going to have to be more specific on why a failing HSI attribute contributes to the undoing of your privacy? You're aware the security attributes are each based on mitigating actual real-world attacks, right?
You're aware that ME itself is considered a security hole, and that a lot of people disabled it, right? Not to mention, most of the hsi2 and 3 stuff need ME as a dependency? Edit: again, why is this any part of a firmware updater? Edit2: this doesn't even get into unsigned kernels, out of tree modules, and unencrypted swaps (or at least not encrypted in the special way fwupd wants them to be)
