Re: Mass bug filing: Cryptographic protection against modification
On Tue, May 04, 2004 at 10:08:29AM -0500, John Hasler wrote:
> I wrote:
> > Doesn't seem likely. What purpose would such a thing serve?
>
> Matt writes:
> > The attempted inclusion of otherwise-DFSG software into Debian main
> > intended to run on hardware which will only accept a crypto-signed
> > binary? Presumably because someone wants Debian to support the hardware
> > in question. I will find it interesting to see whether that software is
> > accepted by ftpmasters and the debian-legal mavens, as the software
> > licence is Free, but the source code is of near-to-zero usefulness, so
> > the question of the Freeness of the source is academic.
>
> But why would a manufacturer ship such a thing? It doesn't protect his
> secrets because he is shipping source, so what is the point?
Aah, yes. The major point I would see is to comply with the letter of the
"Free Software" mantra ("we want source, we want source") while being able
to ensure that bug reports you get are due to problems in what you've
supplied, rather than being caused by whatever random hacks the user made.
Another situation would be where the hardware *has* to be able to really trust
the firmware that is running on it; I presume that crypto systems would
typically be in this boat (modulo some fancy engineering to make the
software untrustneeded (what a word)), and there would also be situations
where you *must* be running validated/tested code (think medical devices) in
order for the total system to be usable.
> > Call it perverse curiousity...
>
> Well, we call them the Debian Free Software _Guidelines_. If the
> crypto-keyed hardware is the only existing hardware the stuff could run on
> I'd call it non-free because the supplied source is incomplete: it does
> not include everything needed to generate a usable binary. In fact, one
> could argue that such a thing is even less free than a plain binary since
> there is no way at all to make modifications: you can't even patch the
> binary.
Ayup. The question which would be considered would be: "does this software
have uses beyond supporting this crypto-protected hardware?". There might
be a way to tell the hardware to ignore the crypto, or there might be a
non-crypto'd version, or the software could contain some useful stuff that
other software could benefit from. But that's going to be a very
case-by-case thing, I think.
> It occurs to me that someone might ship such a thing in a vain attempt to
> reconcile Free Software and some sort of DRM hardware.
Yup, that's a definite possibility. I'm looking very curiously at what all
this Palladium stuff is actually going to do to the world.
- Matt
Reply to: