Re:CVE-2023-40547 – avoid incorrectly trusting HTTP headers
by ajross on Thursday January 25, 2024 @02:40PM
(#39134124)
I'm not the person you should be arguing with. I didn't write the license and I'm not the judge that would have to make the decision. I was explaining why the collision between software freedom and end user security requirements (which is a very real thing!) is seen as a risk to the people shipping and supporting actual hardware.
Re:CVE-2023-40547 – avoid incorrectly trusting HTTP headers
by AshamedCaptain on Thursday January 25, 2024 @02:41PM
(#39134136)
There is no collision _whatsoever_ between software freedom and security requirements. It's an illusion which happens to be highly convenient to those who want to promote an artificially controlled market and sell that as snake-oil security.
Why? Why on earth?
IF Lenovo wanted to really ship a GPLv3 bootloader, all it imposes on Lenovo is they ship a method to install your own bootloader keys. Do you really disagree with that?
Lenovo has already shipped hardware which requires magical incantations to install anything other than Windows (see Secured Core hardware). Why on earth anyone shipping FLOSS software would drop their pants to allow precisely this shitshow is over me.