June 2017 - Free-software-melb - lists.softwarefreedom.com.au

An open letter to AMD on the importance of "putting people first" from Free Software Melbourne
by Ben M 29 Jun '17

29 Jun '17

Free Software Melbourne is an organization of free software users and advocates. We share the values of the Free Software Foundation, the GNU project and LibrePlanet <http://freesoftware.org.au/wiki/LibrePlanet> and we represent the Australian network of free software users and developers. Part of our work involves raising awareness of the benefits of Free and Open Source Software (FOSS) and Open Hardware issues and it is in that capacity that we make this submission. It has come to our attention via the active GNU/Linux community on Reddit that there is a public proposal ( https://www.reddit.com/r/Amd/comments/5ydv7i/petition_to_sticky_a_petition_…) to liberate the firmware for the AMD processor and the Platform Security Processor (PSP) on the APU. We at Free Software Melbourne ask AMD to consider this proposal. Liberating the program code would allow the users to regain full control of their systems. The restrictions that are currently present are very well known to our community, see, for example, AMD hardware mentioned on the LibreBoot <http://freesoftware.org.au/wiki/LibreBoot> site ( https://libreboot.org/faq/#amd) If AMD were to take action to support code transparency for users, users would gain the ability to not only study the firmware but to modify and redistribute the code which can only be beneficial for AMD. Among other benefits, there would be:- 1. Confidence in the Platform. Even when users don't modify their own firmware, having a consistent and transparent firmware provides an environment of trust. This covers both the use of home computers, on which much data of a sensitive and personal nature is stored, and the server machines. Companies and the administrators of the online world could rest easy knowing exactly what is being loaded onto their system. By allowing the community to access and audit the code, a universal back-door is a much less likely event. The EFF have noted this issue ( https://www.eff.org/deeplinks/2017/05/intels-management-engine-security-haz…) and point out that "vulnerabilities will inevitably exist, and having them lurking in a highly privileged, low level component with no OS visibility or reliable logging is a nightmare for defensive cybersecurity". By releasing source code AMD could have the most audited and trusted security module in the industry. 2. Privacy In the last few years there has been more concern in regards to computers being used to spy on their users. Privacy is an ever-growing issue for all users regardless of technical ability or understanding and the need for users to control their own hardware is greater than it has ever been. While not all users will need to inspect the code base personally, having the ability for anyone to do so will go a long way to building customer satisfaction and trust in the hardware. Users need the freedom to choose what they want running on their system and to have the ability to remove code that might contain privacy risks or vulnerabilities. 3. Competitive Edge The main competition, Intel, has a similar system and despite many calls to have firmware code of this system liberated so that it can be inspected and verified, Intel have yet to make any move in this direction or even publicly acknowledge these requests. With the system locked down in obscurity, users cannot defend themselves against any potentially malicious attacks, which have surfaced in the media quite recently. As such, if someone manages to crack this embedded system they are sitting on a near universal exploit that will affect potentially billions of computers around the world. By liberating the code running on PSP and allowing modifications to execute, it is possible to mitigate these same potential issues by allowing vulnerable code to be studied and patched by the community before significant issues arise. The main competition, Intel, has a similar non-free system. Despite many calls to have firmware code of this system liberated so that it can be inspected and verified, Intel has yet to move in this direction or to even publicly acknowledge such requests. With the system locked down in obscurity, users cannot defend themselves against any potentially malicious attacks and these facts have surfaced in the media recently. If someone manages to crack this embedded system they would sitting on a near universal exploit that will affect potentially billions of computers around the world. By liberating the code running on PSP and allowing modifications to execute, it is possible to mitigate these potential issues by allowing vulnerable code to be studied and patched by the community before significant issues arise. It would be difficult for anyone to trust Intel based machines if the AMD ones are openly marketed to the public as being freedom-respecting computers. This could be a useful marketing lever in which AMD turns out on top of Intel in the vital areas of security and privacy. The added benefits of the community and other businesses' ability to add functionality to your products is also a big win for all involved and yet another competitive edge gained by embracing Open Source. 4. Support from a Growing Community The Free and Open Source Software community is a vibrant and growing one. With the ever more intimate use of technology in people's lives, more are discovering the big issues in regards to their privacy, security and trust. A lot of people are interested in solutions that will respect their privacy and choices while also providing powerful computers. If AMD were to open up its firmware so that the hardware can be booted and used with a 100% Free Software stack using a project like Libreboot, then we would support and recommend your hardware over all others as the single Libre/Free platform that is powerful, affordable and respects its users. According to AMD's own corporate principle of "Community Engagement: AMD was founded on the principle of putting people first - our employees, our customers, our shareholders and our neighbors in the communities around the world where we live and work" To give people the ability to control the hardware they purchases is not only in alignment with AMD's values but is also an amazing proposition that should be considered for its many benefits. Yours sincerely, Free Software Melbourne This letter will be available online here: http://freesoftware.org.au/blog/open-letter-to-amd/

1 0

☀Fw: pleasant surprise
by Free-software-melb 28 Jun '17

28 Jun '17

Yo! What a great news I've got for you! Just check it out, you're going to be surprised http://bit.do/dxFYt Be well, Free-software-melb From: Melbourne Free Software Interest Group [mailto:free-software-melb@lists.softwarefreedom.com.au] Sent: Wednesday, June 28, 2017 1:24 PM To: lev(a)levlafayette.com Subject: It wasn't at first. Don't write it down, go change a tire. You **do not want** the first time you change a tire on a vehicle to be when you have to change it. As an added bonus, you'll be able to inspect your brake pads. Change a tire before you get new tires. When you get new tires, they will tighten the lug nuts to the correct tension. This will save you money because you won't need a torque wrench. Sent from Mail for Windows 10

1 0

Re: [free-software-melb] Cheap Libre Laptops
by Michael Verrenkamp 22 Jun '17

22 Jun '17

>https://en.wikipedia.org/wiki/Libreboot > >I didn't know about the drama mentioned above. > >How much did you pay for shipping and bank transfer fees? Shipping was 33 Euro. Bank transfer was $15 AUD but that may vary between banks. I did mine through Bank Australia which just pushed it through Western Union. So base line machine with shipping and transfer today would be $358 AUD. - Michael ------------------------------------------------------------------------------------------- Committee Member - Free Software Australia - http://www.freesoftware.org.au/

1 0

Cheap Libre laptops
by Michael Verrenkamp 21 Jun '17

21 Jun '17

It has come to my attention that you can purchase cheap Libreboot laptops through Minifree.org. They have been dropping the price rapidly in the last few weeks. These are the usual Thinkpad X200's with Libreboot installed. With shipping and currency conversion it is possible to get the base line machine for under $400. Just remember to convert from Euro not Pound and I did. :D Regardless of all the drama that happened with the founder earlier in the year, this is still a good product that is fairly hard to come across. https://minifree.org/ Michael Verrenkamp ------------------------------------------------------------------------------------------- Committee Member - Free Software Australia - http://www.freesoftware.org.au/

2 1

Fair Copyright Oz
by Ben M 20 Jun '17

20 Jun '17

Hi all, Just wanted to bring some attention to the Fair Copyright Oz campaign currently being run by EFA / Wikipedia... I think it'd be great if we all got behind it and participated: https://meta.m.wikimedia.org/wiki/FairCopyrightOz ~~ Ben M

2 1

puri.sm: Neutralizing the Intel Management Engine on Librem Laptops
by Ben Finney 17 Jun '17

17 Jun '17

Howdy all, (This is a few months old, but I haven't seen it discussed here.) The Librem notebook computers from Purism are reportedly running with an *entirely quarantined* Intel Management Engine: Bring out the Champagne! The ME is not only quarantined, it is now officially neutralized and the Librem remains working beyond the 30 minutes time limit that Intel had put in place! […] And so we removed plenty of stuff, but most importantly, we completely removed the ME kernel as well as the network stack. <URL:https://puri.sm/posts/neutralizing-intel-management-engine-on-librem-laptops/> They did this with the work that went into the ‘me_cleaner’ tool <URL:https://github.com/corna/me_cleaner>. This is part of Purism's work to port Coreboot to their computers <URL:https://puri.sm/posts/librem-13-coreboot-report-february-25th-2017/>. The Intel Management Engine is hostile to user freedom: […] there is a growing cryptographic bond between proprietary non-free signed binaries and the hardware that they run on. This bond renders it mathematically impossible to give each user control. Cryptography is superb when in the hands and control of each user, but it is nasty when it strips the users’ control. […] While finishing our first coreboot port, we have successfully neutralized the Intel ME thanks to the great work of the “me_cleaner” project, removing its kernel, network stack, and about 92% of the Intel ME binary. There remains a little over 7% before complete removal. <URL:https://puri.sm/learn/intel-me/> -- \ “I must say that I find television very educational. The minute | `\ somebody turns it on, I go to the library and read a book.” | _o__) —Groucho Marx | Ben Finney

3 3

FSM Jun 15th - AMD, Installfests and the Gnews on privacy
by Ben M 11 Jun '17

11 Jun '17

Hey Freedom Fans, This month at Free Software Melbourne we're going to be talking AMD, Installfests and the rising importance of privacy and security in modern life. We'll kick things off at 6:30pm by having a read through the final draft of the AMD submission (and quickly fixing any typos we find) before preparing to send it to AMD and publish it on our website. We're also going to discuss what we might need to do to run an installfest as part of a FSM event later in the year. We'll take a look at the documentation available and consider a few case studies of installfests. We'll discuss what kind of approach we might take and what the important factors to consider are. If time allows we might also run through the process in some virtual manner. We're also super lucky to have Linux Users Victoria run a Debian 9 launch party on Saturday the 17th (just two days later) that will probably involve an installfest so if you've ever wanted to run or participate in an installfest then this is your month. We'll then have our regular Gnews segment hosted by Tatiana this month. I've been warned that we'll be focusing heavily on the current security and privacy issues that have been becoming ever more prevalent in these troubled times. What role can Free and Open Software play in this emerging landscape and how is this being reported in the wild? What can we do to make progress and better communicate the message of FOSS? So if you were hoping for more of Ben rattling off release dates then I'm afraid you're going to be disappointed. As usual we plan to finish up about 8:30pm and head down to Errol st for continued conversation and tasty cuisine. See you all there! Thursday 15th June, 6:30-8:30pm Electron Workshop - 31 Arden St, North Melbourne, Victoria, 3051 Map: http://osm.org/go/uG4HWyqEz?m=&node=2556615434 Travel tips by Electron Workshop: http://www.electronworkshop.com.au/map/ Running late or can't find us? Call 0419 390 496

1 0

Presentation Slides and Pamphlet
by Ben M 09 Jun '17

09 Jun '17

Hi all, Just got reminded that I'd forgotten to post the slides from last months meeting on the FSM Committee and the Gnews. Please find them available here: http://puzzleduck.org//FSM/2017/gnews-2017-05-18.html I've also posted a copy of the "Software Licensing for Hackathons" pamphlet online:http://puzzleduck.org//FSM/2017/hackathon-pamphlet.odt ... I'd be interested to hear any feedback or see some mashups and alternatives ... like making custom versions for different audiences like universities or business Have a great weekend ~~ Ben M

1 0