They all pose the same danger the same way any car on the road can veer into your lane and kill you. It doesn't mean that's likely or even probable. Yes, by definition closed source software can be changed to do something you don't like without telling you.

But specifically Windows has the track record that it will do this, and when you attempt to stop it, it will attempt to go around you and keep doing it. Random drivers and Raspberry Pi firmware do not have this track record, and so saying they "all pose the same danger" is technically accurate, it's disingenuous to the point of being borderline untrue.

It's not the same danger in the same way, until car steering, et al, have a dependency on proprietary firmware that we can't inspect and understand. In the meantime, the mechanical components can be cut open, their operation understood. What's more likely than uncommanded veering, is you lose power steering, and can't easily steer.

Modern cars have a lot of electronics involved in things like steering, and some researchers already demonstrated that they can take over the steering of a car from remote by exploiting vulnerabilities in those electronics.

True - but I'd argue that the dangers aren't equal, and they are also not constant. Windows 7 wasn't nearly as invasive as Windows 10, for example.

While the argument often seen from the FSF - that all non-free software is dangerous - is technically true, it's about the same level of true as "all software is dangerous if you can't read the source code," in which case, all software is dangerous to everyone who isn't a software engineer.

Even though all non-free software has this issue, we should still be vigilant about fighting and curtailing it where we can. Proprietary software isn't going away, and the harm is real, so we need to encourage its lessening.

> all software is dangerous to everyone who isn't a software engineer

And even everyone who is, unless that engineer understands every language and hardware component in play, and is able to spot subtle vulnerabilities at a glance.

Exactly this.

You have to have some level of trust. That trust should have a pretty high barrier, though.

FOR ME, one of the biggest things I look at is motivation. This often means looking at business models. We've seen where the race to the bottom for laptop prices gets us. I'd rather buy a laptop from a company that makes money off of selling the hardware, itself.

Honestly, I don't see how open/free software can fix it. For example google analytics is commonly used through web, source code of the tracker is available as raw text in javascript, and where is the promise of open/free software? Sure one can install tracking blocker (like ghostery), but just because the track itself is open source (most pages source code is accessible as raw text) - tracking hasn't been magically fixed for web, and people still play cat-mouse with track blockers. Given this example I don't see how making something open source or free software suddenly fixes that. Indeed, yes, it does makes it easier to audit software, but that's about it. One might say that one can personally audit all the source code, but there is practical limit to how much we can do it - a common system might run 20k+ packages with million lines of source code, and even if we trust all major dependencies, tracking can always sneak-in through 3rdparty libs, downloadable code (aka js), etc.

In my opinion a better tool would be a legal framework to limit companies what they can and can't do. For example EU GDPR is much stronger factor in limiting what companies can do with personal data, and it forces companies to provide opt-out option (and proper opt-out, not like "we use cookies, if you don't like - please leave"). The reason why EU GDPR is not a joke are fees - 4% of global revenue (or 20 million EUR, what is bigger), so companies are forced to comply. I would love to see a proper legal framework for opting-out from tracking, but looks like it will take another 10-20 years to develop it :(

>Honestly, I don't see how open/free software can fix it. For example google analytics is commonly used through web, source code of the tracker is available as raw text in javascript, and where is the promise of open/free software? Sure one can install tracking blocker (like ghostery), but just because the track itself is open source (most pages source code is accessible as raw text) - tracking hasn't been magically fixed for web, and people still play cat-mouse with track blockers.

A much better example is the new telemetry in OS Chromium, OS .NET core, and OS VSCode.

It's not really the same game. Having something hidden in a firmware blob vs. installing crapware on a running OS. Thankfully there are cheap SoCs that can run blobless, like Allwinner H5, which runs the Xfce/firefox reasonably fast, and hopefully, this year it will get FLOSS video decoding support, and I'll be happy as a mouse. Mali free software drivers are also being actively worked on, but that's much less interesting.

Finaly a computer I fully control. :) Next, I'd like a tablet I fully control, without all the complexity of Android or traditional Linux desktop environments. Nice small userspace with small tablet GUI apps + HW access server, written in C. All snapping fast without a crazy-bloated SDK. Something that can start in 3-4 seconds including linux boot.

I don’t understand what closed source has to do with it. What’s to stop Google from adding this stuff in a ChromeOS update?

ChromeOS is proprietary.

And what closed source has to do with it is this: if you try to do this stuff in free software, people can simply remove it and distribute the clean version.