Re: more evil firmwares found
@ 25/04/2004 05:43 : wrote Tollef Fog Heen :
* Ryan Underwood
These (PNG, MIDI-derived WAV's) are bad examples, anyway because in
general they can be (somewhat) easily converted back to "source"
(vectorizing software in the first case, note-extraction in the
second...) but our central problem (the "evil firmware" in the Subject:
above) boils down to:
1. there are some (big?) blobs of hex in some source files of the
2. we know in some cases and assume in others that those are "firmware",
i.e., *programs* to be loaded in some other addressing space (that is
not the same of the main CPUs), and to be *executed* by some other
3. in the case our assuptions/knowledge in (2) above is correct, this
could render a debian kernel binary package undistributable;
4. the solution to (3), assuming the worse possible result, while trying
not to hurt debian users, is: (a) to yank the hex blobs from the kernel
source; (b) put the distributable blobs in separate packages in
non-free; (c) work on some way to load the blobs from userspace;
| Is it not DFSG-free if the source .EPS [to the PNG file] is not
Assuming it is software, it might be. It depends on the license of
the PNG file. It would not be ok if the PNG file is GPLed, but I
can't see any problem if it was BSD-licensed, for instance.
If we separate the blobs from the kernel source, all gets well, because
the blobs are not a derived work of the kernel under no assumptions.
What does not get well is the support to hardware that depends on the
blobs to work, so (b)+(c) above would (I think) normalize things.
Except, of course, for these blobs that are deemed undistributable. For
those, other solution might be in order.