linux-kernel - Re: [PATCH] linux-firmware: add MISSING file

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Mon, 21 Jan 2013 01:31:32 +0000
From:	Ben Hutchings <ben@...adent.org.uk>
To:	Pavel Roskin <proski@....org>
Cc:	richard -rw- weinberger <richard.weinberger@...il.com>,
	Xose Vazquez Perez <xose.vazquez@...il.com>,
	Daniel Drake <dsd@...top.org>,
	Ulrich Kunitz <kune@...ne-taler.de>,
	David Woodhouse <dwmw2@...radead.org>,
	linux-wireless@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] linux-firmware: add MISSING file

On Mon, 2013-01-14 at 17:55 -0500, Pavel Roskin wrote:
> On Sun, 13 Jan 2013 00:09:46 +0100
> richard -rw- weinberger <richard.weinberger@...il.com> wrote:
> 
> > > +This file attempts to document the reason why a firmware is not
> > > present +in this bundle.
> > 
> > From the user's point of view this not really helpful.
> > Wouldn't a in-kernel table of known but missing firmware files make
> > more sense? The kernel could write a log like "Yeah, I know this
> > firmware but sadly I don't have it because of ..."
> 
> The firmware file may be absent on the system even if it's in the
> linux-firmware tree.  Conversely, the firmware may be present on the
> system but not in the linux-firmware tree.
> 
> The kernel doesn't know whether the firmware is missing due to
> licensing issues or due to misconfiguration.  The kernel cannot know
> that.  And I don't think the kernel should include as much information
> as the MISSING file would include.

I can see some value in an index explaining where to get firmware,
whether it's available from the copyright holder or some licensee or
must be extracted from Windows drivers with a particular tool.

I'm not sure whether linux-firmware.git is the right place for that,
though.  Would distributions include this in their packages and would
users be able to find it there?  Would a wiki page be more useful?

Putting my Debian hat, I can say that we don't distribute any of the
older files that are 'GPL but no source visible', while we do distribute
some files not included in linux-firmware.git that require click-wrap
licences.  I also prune files that aren't referenced by the kernel
version in any current release.  So a file that says what's missing from
linux-firmware.git would not be that useful to Debian users, for
example.

Ben.

-- 
Ben Hutchings
Q.  Which is the greater problem in the world today, ignorance or apathy?
A.  I don't know and I couldn't care less.

Download attachment "signature.asc" of type "application/pgp-signature" (829 bytes)