Microcode update conundrum (was Re: ANNOUNCEMENT: Intel processor microcode security update)

[Joel Rees <joel.rees@gmail.com>]

(I kind of hope this starts a flame war large enough to embarrass the
corporate culprits into behaving themselves about this. Apologies in
advance when I step on toes.)

I was hoping that AMD was not going to have the license and
non-visibility issue that plagues the Intel processor microcode
updates. But I find this original announcement from when Henrique made
the updater tool available:

http://lists.debian.org/debian-devel/2012/11/msg00109.html

And that shoots that dream. So,

(1) This requires enabling two repositories that I have been avoiding
enabling, contrib and non-free. That means I have to watch the
repository more carefully when using

    apt-cache search

or synaptic to look for new tools, right? Or can we just enable those
two repositories long enough to load Henrique's tool and the microcode
updates, then disable them again?

(2) Are there any CPU manufacturers who are not plagued by this
ultimate refusal to let computer owners actually own their computers?
How do the ARM manufacturers do?

(2a) Is debian running on any of the open core CPUs? (I don't remember
any evidence of such, but maybe I just missed it?)