Binary drivers are great!

[n0cmonkey]

http://www.infoworld.com/article/06/06/21/79536_HNwifibreach_1.htm

Security researchers have found a way to seize control of a laptop computer by manipulating buggy code in the system's wireless device driver.

Keep accepting those binary only drivers instead of real support from the companies who make your computer parts. :beer:

 

[Nothinman]

The page you requested cannot be found.

 

[n0cmonkey]

I lost an l.

 

[SleepWalkerX]

Well in this case, binary-only driver support isn't the problem. Its how fast the company that creates these drivers distribute a fix.

I, of course, would rather trust a hardware manufacturer that open-sources drivers as opposed to one that doesn't. At least if I was worried enough I can depend on trusted individuals/organizations or myself to modify the code accordingly.

 

[Atheus]

Any idea what specific drivers are affected? Hopefully not mine... although it looks like you have to break the encryption and connect to the network before this will work.

 

[n0cmonkey]

I thought the article said you didn't have to connect to the network for this to work. Or was it just the victim?

 

[Nothinman]

although it looks like you have to break the encryption and connect to the network before this will work.

Read the article again, it says that the victim machine just has to have their driver loaded and antenna enabled.

 

[SleepWalkerX]

The victim would not even need to connect to a network for the attack to work.

"You don't have to necessarily be connected for these device driver flaws to come into play," Ellch said. "Just because your wireless card is on and looking for a network could be enough."

More than half of the flaws that the two researchers found could be exploited even before the wireless device connected to a network.

 

[Markbnj]

Keep accepting those binary only drivers instead of real support from the companies who make your computer parts

Explain to me how binary-only drivers are related to this problem? I don't think the average wireless laptop user is going to rush out to patch their driver source and rebuild. Nor should they be getting patched drivers from anyone other than the OEM, imo, for most people anyway.

Sorry, I don't see the connection.

 

[Nothinman]

Explain to me how binary-only drivers are related to this problem?

By the fact that with the use of binary-only drivers you're at the mercy of the company and the competence of their developers. Of course no one is saying that OSS software is bug free, but with proper peer review the chances are lower and fixes are usually available faster.

 

[n0cmonkey]

Originally posted by: Markbnj

Keep accepting those binary only drivers instead of real support from the companies who make your computer parts

Explain to me how binary-only drivers are related to this problem? I don't think the average wireless laptop user is going to rush out to patch their driver source and rebuild. Nor should they be getting patched drivers from anyone other than the OEM, imo, for most people anyway.

I bet most of the linux users using a wireless card would update their drivers if they heard there was a major vulnerability in it, whether they patched and compiled it themselves or downloaded the binaries of the open source drivers from their distribution. And OpenBSD users can definitely do this since all of their drivers _are_ open source.

But there are some idiotic companies clinging on to stupidity and releasing binary drivers, or binary blobs with open source wrappers instead of tech specs. These are a problem. And the people that buy this junk are a problem. They refuse to buy something with open specs (ralink, realtek), and instead go for one of these stupid companies that will not tell us how to use the hardware we have purchased from them (atheros, intel, broadcom, ti).

Sorry, I don't see the connection.

Only because you are not paying attention. 🙂

 

[Nothinman]

These are a problem. And the people that buy this junk are a problem. They refuse to buy something with open specs (ralink, realtek), and instead go for one of these stupid companies that will not tell us how to use the hardware we have purchased from them (atheros, intel, broadcom, ti).

Most of the time the consumer isn't the problem, it's the OEM. When you buy a new laptop you have virtually 0 say in what wifi card is included in the thing and about 99% of the time it's either Intel or Broadcom. Sure it's possible to buy a USB or PCMCIA card and use that instead, but most people would rather use whatever's built in since it's more convenient.

The worst part is that Intel took the first steps, they released GPL'd drivers which even though they require their binary-only firmware isn't terrible. But their last release with that binary-only daemon is just stupid, I hope they realize how big of a blunder that was and fix it.

 

[n0cmonkey]

Originally posted by: Nothinman

These are a problem. And the people that buy this junk are a problem. They refuse to buy something with open specs (ralink, realtek), and instead go for one of these stupid companies that will not tell us how to use the hardware we have purchased from them (atheros, intel, broadcom, ti).

Most of the time the consumer isn't the problem, it's the OEM. When you buy a new laptop you have virtually 0 say in what wifi card is included in the thing and about 99% of the time it's either Intel or Broadcom. Sure it's possible to buy a USB or PCMCIA card and use that instead, but most people would rather use whatever's built in since it's more convenient.

Don't buy that laptop. Customize it and don't get something built in. Go get a better chipsetted mini-PCI card. There are alternatives, but the consumers are lazy and stupid, therefor a problem. 😉

The worst part is that Intel took the first steps, they released GPL'd drivers which even though they require their binary-only firmware isn't terrible. But their last release with that binary-only daemon is just stupid, I hope they realize how big of a blunder that was and fix it.

OpenBSD has a totally free driver for that chipset, and I think they mentioned that relatively minor modifications in the Linux kernel might allow the gpled driver to work without the daemon.

EDIT: They still aren't releasing docs though. Even GPLed drivers can't make up for that.

 

[Markbnj]

Only because you are not paying attention

I'm paying attention, and probably more than the subject warrants 😉. The answer to these kinds of problems is not open source drivers. The fact that a few Linux laptop users would benefit doesn't constitute a reason for OEMs to release their driver source. You guys don't get the basic point that computers are not about technically-astute geeks anymore. When a part doesn't work right, what's good for 99% of the users in the world is to have it replaced, quickly, by the OEM. They aren't going to turn to an online techie comminity for support anymore than they turn to a techie community to support their refrigerators. They don't want the tech specs and raw materials; they want the thing fixed.

The OEM, at the same time, does not want a half-dozen technical users patching their drivers and releasing different versions into the public domain. Why would they? They know damn well that 99 out of 100 users, if they have a problem, are going to go to _their_ website, or call _their_ toll-free service line, or contact their channel partners, and not turn to online forums and user groups for assistance. Computers are not a hobby anymore. They're appliances. Even if they fail to live up to the description at the moment, that doesn't change where the market is going, and what the user demographic is.

 

[n0cmonkey]

Originally posted by: Markbnj
I'm paying attention, and probably more than the subject warrants 😉.

No doubt. 🙂

The answer to these kinds of problems is not open source drivers.

The problem is crappy drivers. The solution is good drivers. For open source operating systems, the best drivers are open source.

The fact that a few Linux laptop users would benefit doesn't constitute a reason for OEMs to release their driver source.

You stopped paying attention again. No one is asking them to.

You guys don't get the basic point that computers are not about technically-astute geeks anymore.

We get that, we don't care. 🙂 And that has absolutely nothing to do with either problem (no documentation for open/free drivers and crappy drivers).

When a part doesn't work right, what's good for 99% of the users in the world is to have it replaced, quickly, by the OEM. They aren't going to turn to an online techie comminity for support anymore than they turn to a techie community to support their refrigerators. They don't want the tech specs and raw materials; they want the thing fixed.

I want things fixed too, and I know who will do it. Not the OEMs, they won't support their customers. The OpenBSD developers will fix the problems with the drivers they wrote.

The OEM, at the same time, does not want a half-dozen technical users patching their drivers and releasing different versions into the public domain. Why would they?

Why would they care if there are 100 different drivers out there?

They know damn well that 99 out of 100 users, if they have a problem, are going to go to _their_ website, or call _their_ toll-free service line, or contact their channel partners, and not turn to online forums and user groups for assistance.

What does that have to do with the open source community? Why can't they release good drivers in the first place? Why not spend 2 minutes to release documentation on how to interface with the hardware? Simple solution for a simple problem, but most companies are too stupid to see it.

Computers are not a hobby anymore. They're appliances. Even if they fail to live up to the description at the moment, that doesn't change where the market is going, and what the user demographic is.

I don't care about the demographic. What I care about is if the hardware I buy works properly. Coincidentally it does, but that's because I pay attention to the companies that care about their customers. 🙂

The two main problems I see are:
1. Companies release crappy drivers. This isn't an FOSS thing, this is a universal problem.
2. Companies do not release documentation on interfacing with the hardware for FOSS developers to create drivers. This is a stupidity thing. Thankfully some companies in Taiwan just get it.

Neither of these problems will be solved by US companies, and neither will be solved by ignoring customers. Even if those customers are a small group.

 

[Markbnj]

The problem is crappy drivers. The solution is good drivers. For open source operating systems, the best drivers are open source.

We agree on the first two sentences. The third is immaterial. When open source operating systems are a significant component of the market, companies will devote resources to supporting them.

You stopped paying attention again. No one is asking them to.

Of course you are. You complain about it all the time. In your case you narrow the request and complain that they aren't supporting open O/S's with open drivers, but the point of the original post was surely to mock the closed source world's reliance on binary components.

We get that, we don't care. And that has absolutely nothing to do with either problem (no documentation for open/free drivers and crappy drivers).

This is not about open/free drivers, since we're talking about laptops. That also means it is not about open operating systems, which are a tiny niche in laptops. This is about suggesting that the open source model would do a better job of supporting mainstream laptop users than the proprietary model, and that's what I disagree with.

I want things fixed too, and I know who will do it. Not the OEMs, they won't support their customers. The OpenBSD developers will fix the problems with the drivers they wrote.

Then the solution is to pressure OEMs into doing a better job, or buy from different OEMs. I'm not saying that's how it will be every time. There have been many OEMs over the years who have done a crappy job of support, and given rise to user communities who hack up their stuff to make it work. But that's not a business strategy; it's a failure.

Why would they care if there are 100 different drivers out there?

They care because the average Joe user is going to call them when there's a problem, as I said. The average Joe user is going to call them just to figure out which of the 100 drivers to use.

What does that have to do with the open source community? Why can't they release good drivers in the first place? Why not spend 2 minutes to release documentation on how to interface with the hardware? Simple solution for a simple problem, but most companies are too stupid to see it.

It has nothing to do with the open source community, just like almost all of what goes on in consumer computing. What makes you think it does? Is the open source community important to laptop builders? Asking why they can't release good drivers in the first place is silly. It's because they aren't putting the resources into it, and that's because the margin on hardware is really low. You know all this. It's a big problem for them, and it's a big problem in their relationships with customers and channel partners, and the open source community is relevant to, um, 0 percent of it.

I don't care about the demographic. What I care about is if the hardware I buy works properly. Coincidentally it does, but that's because I pay attention to the companies that care about their customers.

Yeah, well so do we all, and if you take care to buy from better OEMs then you are doing just about everything you can to solve the problem. Saying you don't care about the demographic is equivalent to declaring that you aren't interested in the realities of the problem. Businesses care about their markets. Open source adherents are not the market. Linux tweakers and driver developers are not the market. The people on this forum are not the market.

 

[Nothinman]

When open source operating systems are a significant component of the market, companies will devote resources to supporting them.

Companies are devoting resources to them, it's just that they're not always going about it the right way.

This is not about open/free drivers, since we're talking about laptops.

It's not all about laptops, the example was about bad wifi drivers that are common in laptops but it's not limited to them and even so there are lots of people with wifi hardware in other machines.

 

[n0cmonkey]

Originally posted by: Markbnj
We agree on the first two sentences. The third is immaterial. When open source operating systems are a significant component of the market, companies will devote resources to supporting them.

That's just it, they don't really have to. All they have to do is open some documentation to the community.

Of course you are. You complain about it all the time.

No, I don't. I don't care if they open source their drivers. It wouldn't affect me. They can open up documentation to write those drivers and I'd be happy. That's all the FOSS community needs. They hand out a pdf, and the drivers will be written for them.

In your case you narrow the request and complain that they aren't supporting open O/S's with open drivers, but the point of the original post was surely to mock the closed source world's reliance on binary components.

No, I don't mind using closed source drivers on closed source platforms. I do it all the time. I have a Windows machine and several Macs. I want FOSS drivers for my FOSS systems. I want the ability to use the same hardware in just about every one of my computers, no matter the OS.

This is not about open/free drivers, since we're talking about laptops.

What do laptops specifically have to do with anything?

That also means it is not about open operating systems, which are a tiny niche in laptops. This is about suggesting that the open source model would do a better job of supporting mainstream laptop users than the proprietary model, and that's what I disagree with.

That's not what this is about. It's pointing out an issue that could affect Linux, FreeBSD, NetBSD, and DragonflyBSD by accepting these binary blobs from hardware manufacturers. There are bigger issues to worry about if you're using Windows or Mac OS X than the crappy drivers you're forced to put up with. 😉

Then the solution is to pressure OEMs into doing a better job, or buy from different OEMs.

And I do. Both. You forgot to try and inform the community about the good guys, the vendors that care about their customers, no matter what platform they want to use. 😉

They care because the average Joe user is going to call them when there's a problem, as I said. The average Joe user is going to call them just to figure out which of the 100 drivers to use.

They use the one that came on the CD with their hardware/system. They use the one that appears in Windows Update. They will use those drivers, blissfully unaware of the existance of anything else.

It has nothing to do with the open source community, just like almost all of what goes on in consumer computing. What makes you think it does? Is the open source community important to laptop builders? Asking why they can't release good drivers in the first place is silly. It's because they aren't putting the resources into it, and that's because the margin on hardware is really low. You know all this. It's a big problem for them, and it's a big problem in their relationships with customers and channel partners, and the open source community is relevant to, um, 0 percent of it.

The open source community is getting bigger every day. I can't think of a company off the top of my head that doesn't use open source in one way or another...

Yeah, well so do we all, and if you take care to buy from better OEMs then you are doing just about everything you can to solve the problem. Saying you don't care about the demographic is equivalent to declaring that you aren't interested in the realities of the problem. Businesses care about their markets. Open source adherents are not the market. Linux tweakers and driver developers are not the market. The people on this forum are not the market.

We may not be the biggest part of this mythical market, but we are consumers. If we buy the products they make they owe us a minimum of support. Releasing documentation WHICH TAKES NO WORK ON THEIR PART is a minimum of support. They lose nothing and potentially gain customers.

RALink did it. Realtek did it. LSI did it.

 

[n0cmonkey]

Originally posted by: Nothinman
It's not all about laptops, the example was about bad wifi drivers that are common in laptops but it's not limited to them and even so there are lots of people with wifi hardware in other machines.

You mean the laptops utilizing wifi aren't only connecting to other laptops utilizing wifi? 😕

:beer::evil:

 

[Markbnj]

What do laptops specifically have to do with anything?

I think it's pretty clear that the original story, and the original post, was primarily an issue with laptops. We can debate that all day, and post stats on where the majority of wireless connections are coming from, but it's really irrelevant, because my point is valid whether you're talking about laptops or desktops in the consumer space. The original post is of the "Haha this wouldn't happen under open source" variety (wrong), and you're now saying the subject is why the OEMs won't at least support the open source community with... openess. See below.

Releasing documentation WHICH TAKES NO WORK ON THEIR PART is a minimum of support. They lose nothing and potentially gain customers.

Lol. Man, you must never have worked in a large company. It takes work just to decide whether to have a meeting to decide whether to release documentation. If the current lack of documentation is due to a policy, then it will take even more effort, and a lot more meetings, to build a consensus to change it. It's not like Harry in product support can read this forum and go "Damn, you know what? n0cmonkey is right! We're releasing documentation!"

So yeah, it takes work, and effort, and resources have to spend time looking at it, and that won't happen unless there is a payback. That payback could be money, or publicity, or even just getting activists off their backs.

 

[n0cmonkey]

Originally posted by: Markbnj
I think it's pretty clear that the original story, and the original post, was primarily an issue with laptops. We can debate that all day, and post stats on where the majority of wireless connections are coming from, but it's really irrelevant, because my point is valid whether you're talking about laptops or desktops in the consumer space.

Your point being that companies create good drivers and their lack of support to all of their customers is ok and the right thing to do?

The original post is of the "Haha this wouldn't happen under open source" variety (wrong), and you're now saying the subject is why the OEMs won't at least support the open source community with... openess. See below.

I didn't say this couldn't happen in the FOSS world. Not at all. I just say it's less likely. The driver writers care a bit more about what they write than some drone in a cubicle. 😉

If FOSS projects use binary blobs they cannot do this auditting. When there is a flaw they cannot fix it. When a new product comes out the company can EOL support for the old and the developers cannot continue it. If the company stupidly makes the blob x86 only my PowerPC, sparc4m, and sparc4u systems feel left out and rejected.

There are plenty of reasons to avoid binary drivers in FOSS OSes.

Plus, a lot of open drivers get auditted quite a bit for security issues. Which is a plus. I don't think most companies care about security yet.

Lol. Man, you must never have worked in a large company. It takes work just to decide whether to have a meeting to decide whether to release documentation. If the current lack of documentation is due to a policy, then it will take even more effort, and a lot more meetings, to build a consensus to change it. It's not like Harry in product support can read this forum and go "Damn, you know what? n0cmonkey is right! We're releasing documentation!"

That's a problem within the company. If there is so much bureaucracy to get things done quickly and easily then there is a problem. Someone at these companies should be able to make a simple decision: to support customers. Right now there are a lot of companies that cannot make that decision, and it's pathetic.

So yeah, it takes work, and effort, and resources have to spend time looking at it, and that won't happen unless there is a payback. That payback could be money, or publicity, or even just getting activists off their backs.

And all of these are being offered to the companies willing to do what is right.

 

[Markbnj]

Your point being that companies create good drivers and their lack of support to all of their customers is ok and the right thing to do?

I think it's pretty clear that my point is that open source drivers are not the answer to the problems of proprietary binary drivers. 🙂.

That's a problem within the company. If there is so much bureaucracy to get things done quickly and easily then there is a problem. Someone at these companies should be able to make a simple decision: to support customers. Right now there are a lot of companies that cannot make that decision, and it's pathetic.

Decisions at large companies are never simple, unless the place is run by an entrepreneur who controls the board and the decision goes all the way to the top. Of course, getting it there is hard in itself. So your assertion that changing their ways involves no work or cost on their part is just not true. Saying it's a "problem in the company" doesn't really change things.

 

[drag]

I think it's pretty clear that my point is that open source drivers are not the answer to the problems of proprietary binary drivers.

It's a good answer to MOST of the problems presented by binary drivers.


The #1 cause of flaws in the Linux kernel, security or otherwise, is specificly caused by hardware drivers. All things considured the 'core' parts of the Linux kernel are probably the most bug free hunk of complex software your going to find anywere.. However it's drivers for hardware is were the majority bugs reside.

Now realise that, and then realise that generally speaking closed source drivers are of magnatude more buggier then the free software version.. This is due to a veriaty of reasons. The major reason is that most PC hardware companies don't have large budgets for developing software drivers. They spend all their time, money, and other development resources on developing the next generation of products that they are going to release. Now out of this limited software development budget the Linux kernel only would gather a tiny fraction of the money alocated. Also speed to market is very important...

Just remember some facts,
Hardware development companies are hardware development companies.. Not kernel developers. They usually lack experteise.
They usually lack the budgets to do proper drivers.
The usually lack the programmers to do proper drivers.
The usually lack the time to do proper drivers.

'FOSS' drivers are a much better way to go for the majority of cases.

Even when companies DO release open source drivers the lack of initial code quality is usually fairly shocking. It can take developers a long time to get it up to even the relatively low standards of Linux kernel development. Closed source drivers aren't any better then those and there is no hope for code review by anybody that knows anything about realy working on the Linux kernel (or BSD kernel or any other kernel otherwise).

And often closed source drivers are purposely deceitefull. For instance Adaptec has it's 'Host raid' SATA hardware for doing 'hardware' raid on Linux. These things are the most obvious reason why closed source drivers are a 'bad thing'. Linux software MD raid is faster and most stable then the closed source drivers being used on these devices. The closed source drivers are specificly used to hide the fact that these expensive 'server' cards people are buying to drive their sata raid arrays are no more then cheap generic sata chipsets gussied up to meet some sort of bullet point feature set people use to compare and buy hardware.

I mean look at this mess:
http://linuxmafia.com/faq/Hardware/sata.html
http://www.brentnorris.net/blog/?p=158

I mean you just can't go into a store and pick out which devices are real hardware raid vs software raid anymore. And if your unlucky to get a device with closed source drivers chances are you won't be able to use the operating system you want to use.

The only time were closed software drivers are even nessicary anymore is video card drivers. And that's only specificly ATI's latest stuff and Nvidia's stuff. For every other peice of hardware you can find anywere.

Now not only you have to deal with the higher chances of closed source drivers taking your machine down and corrupting your data things like bluetooth drivers and wifi drivers and other software radio-related items are a security risk.

 

[n0cmonkey]

Originally posted by: Markbnj

Your point being that companies create good drivers and their lack of support to all of their customers is ok and the right thing to do?

I think it's pretty clear that my point is that open source drivers are not the answer to the problems of proprietary binary drivers. 🙂.

FOSS drivers solve all of the problems I can think of with proprietary closed source drivers. Which ones aren't solved?

 

[Markbnj]

We're talking past each other here, and I have better things to do... ok, no I don't, but still 😉.

Ok, I will stipulate that open source drivers solve all of the problems that users of open source operating systems encounter with proprietary binary drivers.

Whew. Well, now that we've taken care of the .03% of people affected by the problem reported in the OP who are using Linux, what about the other 99+% who are running Windows XP on their laptops? Will open source drivers solve all their problems too?