News for hackers. Stuff that matters.

A comment on The PinePhone could bring the Linux mobile ecosystem to life. Parent comment

Re:The PinePhone could bring the Linux mobile ecosystem to life by posguy on Sunday June 13, 2021 @03:05PM (#27495296)
Fuchsia has separated the drivers from the kernel[1], enabling proprietary drivers that are never updated to become acceptable. This can result in Blueborne[2], GPU vulnerabilities[3], and any other proprietary driver remaining permanently vulnerable as the hardware manufacturer has no incentive to update the driver.

In Fuchsia's model, you can run the latest OS with these vulnerable, non-updated drivers, or your device ODM could even release nothing and you don't have the GPLv2 to fall back on to get the Board Support Package for your hardware to build your own updates with.

1 - https://www.theverge.com/2020/12/8/22163225/google-fuchsia-o...

2 - https://en.wikipedia.org/wiki/BlueBorne_(security_vulnerabil...

3 - https://redd.it/s48lz

[ Parent | on HN ]
Re:The PinePhone could bring the Linux mobile ecosystem to life by spankalee on Sunday June 13, 2021 @03:36PM (#27495580)
Those types of driver vulnerabilities are exactly why Fuchsia's sandboxed driver model is needed.
[ Parent | on HN ]
Re:The PinePhone could bring the Linux mobile ecosystem to life by kelnos on Sunday June 13, 2021 @10:34PM (#27498684)
I see that as a sort of capitulation. What is actually needed is manufacturers who remain responsible and responsive when it comes to the quality of their drivers. They need to support them much longer than they currently do, and they need to release security fixes promptly.

I think having a sandboxed driver model is a great idea in general, but this will only encourage hardware manufacturers to care even less about supporting their drivers beyond the initial more-or-less-working release.

[ Parent | on HN ]
Re:The PinePhone could bring the Linux mobile ecosystem to life by zepto on Monday June 14, 2021 @12:23AM (#27499278)
> What is actually needed is manufacturers who remain responsible and responsive when it comes to the quality of their drivers. They need to support them much longer than they currently do, and they need to release security fixes promptly.

That requires a level of investment in engineering competence that they aren’t doing because there is little incentive.

How would you suggest changing that?

[ Parent | on HN ]
Re:The PinePhone could bring the Linux mobile ecosystem to life by fsflover on Monday June 14, 2021 @03:52AM (#27500333)
When the support ends, drivers must be open-sourced.
[ Parent | on HN ]
Re:The PinePhone could bring the Linux mobile ecosystem to life by zepto on Monday June 14, 2021 @09:47AM (#27502462)
That’s just a wish.

How do you create the incentive for it?

[ Parent | on HN ]
Re:The PinePhone could bring the Linux mobile ecosystem to life by fsflover on Monday June 14, 2021 @11:29AM (#27503774)
I think that just must be a law. I see no other possibility.
[ Parent | on HN ]
Re:The PinePhone could bring the Linux mobile ecosystem to life by zepto on Monday June 14, 2021 @02:47PM (#27506591)
How would the law define ‘support ends’?

Also seizing source code at gunpoint seems antithetical to the notion of free software.

[ Parent | on HN ]
Re:The PinePhone could bring the Linux mobile ecosystem to life by fsflover on Monday June 14, 2021 @03:58PM (#27507499)
This is the question of security, see https://news.ycombinator.com/item?id=27387169.

> How would the law define ‘support ends’?

Whenever the company refuses to fix security bugs.

[ Parent | on HN ]
Re:The PinePhone could bring the Linux mobile ecosystem to life by zepto on Monday June 14, 2021 @04:27PM (#27507861)
What if they don’t refuse - but are just slow or inefficient or produce bad fixes?
[ Parent | on HN ]
Re:The PinePhone could bring the Linux mobile ecosystem to life by fsflover on Monday June 14, 2021 @04:48PM (#27508104)
There exist more or less standard times for fixing security bugs. Let's say 90 days. If a company cannot provide security for their customers in a reasonable time, they must be held accountable.
[ Parent | on HN ]
Re:The PinePhone could bring the Linux mobile ecosystem to life by zepto on Monday June 14, 2021 @04:56PM (#27508198)
Sure - typically the remedy for negligence would be compensation for the impact.

Seizing property at gunpoint doesn’t seem related to this.

[ Parent | on HN ]