I agree with you that you should be able to run whatever since in the end it’s just another computer, but the manufacturers believe otherwise since there’s “valuable IP” or whatever (insert rollseyes emoji here).

There are open specs like redfish but still doesn’t get to the heart of the matter.

AMI sells a bmc software stack, https://www.ami.com/megarac/ Intel and small manufacturer were unhappy, about always paying the ami tax. So intel created openbmc, as a hedge against ami's monopoly for small manufacturers. I have heard Openbmc has user from facebook, google, ibm, bytdance, and ali.

Dell owns their own stack in idrac, I have heard most of their systems are nuvoton based. I am suspect dell pays some big bucks to keep their systems at feature parity with the other options, and they view it as a an investment.

There are also silicon devices on the motherboard, that have drivers that are not able to be shared. So it not surprising that companies don't share source in a way that would be useful.

If you wanted a system that as a bmc that could be tested try the asrock-e3c246d4c, it looks like there are hobbyist, that have it running coreboot, and openbmc. (impressively)

https://9esec.io/blog/coreboot-on-the-asrock-e3c246d4c/

https://github.com/AspeedTech-BMC/openbmc (or see the upstream OpenBMC tree)

HPE are adding some OpenBMC support https://www.hpe.com/us/en/compute/openbmc-proliant-servers.h...

This work from Supermicro looked promising https://lore.kernel.org/openbmc/CACPK8XdE0sRmt4x54YJVJO2wDT5...

Definitely an area where a more open ecosystem would improve the pace of innovation.

GPL can force manufacturers to cooperate with users. Of course, they can still use closed source binary modules and userland programs ...

The BSD "freedom" is not for the user of the software, it's for corporation to take.

The original BSD release will stay open and free for everyone to utilize.

If it's GPL you can at least interrogate the code release and make an informed decision

https://airbus-seclab.github.io/ilo/BHUSA2021-Slides-hpe_ilo...

BMCs lack the security fundamentals and often behave like cheap IoT knock-offs. They often use outdated kernels, libraries, and security mechanism.

Woe betide you if you run into one of the BMC implementations that shares a host network interface; no separate cable! These things are terrible from a security standpoint.

I mostly work in the cloud now but when I last had to manage a bunch of physical machines we had a physically separate network accessed via its own VPN to get onto the BMCs. Because yeah, the security situation was a joke.

Id put money on there being preauth vulnerabilities in those things, judging by the engineering quality.

On a much less-important note, it might explain some weirdness I'm seeing lately with one of my home Supermicro servers. (The docs say the BMC should only listen on one port, but the switch still sees some degree of responsiveness on the normal non-management port when "off".)

https://tinypilotkvm.com/