This is nonsense.

What you describe is the current state of affairs for CPUs. Intel, AMD, ARM, and every other company working in this space already "put all of their stupidity inside it in the name of features and security". These companies will continue to "put all of their stupidity inside" their products as long as innovation continues.

As Spectre and Meltdown demonstrated, bugs like these occurred in almost every CPU that allows speculative execution. Open projects will simply address these bugs as they are discovered just as private companies do for their proprietary design. Openness is orthogonal to this class of bugs.

> The entire time of kernel devs will be spent working around the various 'features' of the OEM designs.

No they wont. If a CPU spec is implemented by a large number of vendors, kernel devs will (must?) treat their support as they treat peripherals: They will provide support for the baseline CPU as is described in the open spec. Additional support is supplied either by the manufacturer or by volunteers who want to take advantage of additional features.

> But putting everything up on GitHub is a recipe for disaster.

I'll gladly take fragmentation if it means that we are no longer forced to accept ME, PSP, or TrustZone. Competition and diversity is a good thing. It's having only closed CPUs that's the recipe for disaster.

No you're conflating two different issues here. An open architecture with a copyleft license would be resistant to the abuse you just identified. An open architecture that allows closed changes would do what you're saying, and is the major fault of Android.

Why doesn’t this happen with linux, in your opinion? Is it the license?

This does happen in Linux till some extent. Look at wayland for example. Broken on nvidia hardware because nvidia favors its own implementation.

The reason why this does not happen with Linux kernel is because Redhat and Canonical go to great lengths to backport kernel patches, which by proxy affect all the distos based on them. Also because Linux desktop is not big enough for OEM's of the majority of PC users to care about.

Android is a flavour of linux that went big. The fact that OEM's can clone the kernel and put their own drivers into it without being forced to update is what causes the most grief in Android world.

Linux proper, ie the kernel, allows things like modules and has a powerful userspace. Most purposes are met by taking vanilla Linux and dropping some modules and userspace applications on it. You don't have to do a hard fork of the code.

But if you're talking about distros (or some vauge distro-like prepackaged blob of Linux + userspace), it does happen. There are a lot of specialized Linux distros out there, and they aren't all on long-term support with security backporting.

It happens with Windows. It has nothing to do with openness, it happens with all OEMs.

It is. The kernel is GPL; the copyleft license protects the commons from exploitation without releasing the source code, which allows people to fix these things. It does happen to Linux userspace though because a lot of that is not copyleft (which is fine, people should decide each component themselves).

Nonsense. OEM can buy ARM "IP" and jam it into a SoC with plenty of poorly designed tweaks and additional devices and it's not happening.

Also, open does not mean that random changes are allowed as part of the original design. You can have a license that prevents using the original name of a CPU on modified versions.

> SoC with plenty of poorly designed tweaks and additional devices and it's not happening

It's called Qualcomm.

Most OEM's do not have the money to buy ARM IP. Those that have money, i.e, Samsung, Huawei and Apple, are doing it. AFAIK open does mean that I can fork and make whatever changes I want to the original design. I cannot use the name, but i can use everything else.

As I understand it, the ARM IP license that allows companies to customise the actual cores is very expensive, still requires the resulting customisations to comply with the ARM specification, and relatively few companies have the resources to do so.

Customization != "plenty of poorly designed tweaks".

I was replying to the parent using the word "disaster"

I don't understand why people feel the need to downvote comments, only because they don't agree or they don't want to hear any critical thoughts about something they like.

Anyway, your points are certainly valid. However, they are not a "will happen", but rather a "may happen". In FOSS, it took some time too, to find a working governing structure for large projects. A respected BDFL seems to help. Who knows what would be the best set-up for hardware.

But it should certainly be tried.

This is the purpose of the GPL and copyleft licenses: to create a commons that companies can't exploit in the manner you described. The problem with Android is that the parts that aren't the kernel are not copyleft. This allows vendors to shove stupid stuff in there and not release the code. If a chip spec uses copyleft correctly (e.g. no sacrificing to LGPL style things on the edges) this won't happen.

Google is fixing it (for them) with Fuchsia.

Do you just mean that a popular open architecture will lead to more competition and variation in implementations, which will require more work by kernel developers versus just having a much smaller number of closed-design CPUs?

Is not ARM open (but you need a license to build it) ? There are several ARM variants (Qualcomm, Samsung, even Apple) even today.

> you need a license to build it

That's the opposite of "open".