Debian's
announcement to release
Squeeze
with a completely free Linux kernel caused quite some
attention, which is actually a good thing. However, it also seems to have
caused quite some uncertainty and was often partially misunderstood and
miss quoted. I'll try to summarize and answer some of them in this blog
post:
- Myth:
Debian removed all firmware files from its kernels!
Fact: No, it's just about the kernels, which will be shipped with the
upcoming release Debian 6.0 Squeeze
. The kernels in the current stable release
Debian 5.0 Lenny
remain as they are... Well, of course we will
release security updates for them, but they will still contain the same
firmware files as the present kernels.
- Myth:
Debian is ripping stuff out of it's kernels
Fact: Debian moved some firmware files from its main archive to the
non-free
part of the archive. They are still there, just in the part of archive for
stuff not satisfying our Free Software
Guidelines.
- Myth:
Debian will be uninstallable for many users
Fact: The non-free firmware files are still available over our
infrastructure. Those, who are needed during installation (e.g. for
network or storage controllers) can also be loaded during the
installation (be it from CD or USB-Stick). We offer
tarballs
with these files (just unpack them on a usb-stick and plug it in
when asked) as well as netinstall
iso images already containing these non-free files. Of course
these will stay there, after Squeeze
has been released, too.
- Myth:
Firmware files are needed, ripping them out doesn't
accomplish anything and isn't good for our users
Fact: Firmware files are needed by some drivers for some specific
hardware, yes. But not all users want them. And, as we are now able
to load all these firmware files when needed (in stead of compiling them
into the driver itself), we are now able so ship them separately, why
not do so? That allows those, who need non-free firmware to use them,
while those, who don't want them, to not install them at all.
- Myth:
Ah, those Debian freedom zealots again...
Fact: It's not only us, actually, without the cooperation of many
Linux Kernel developers, we couldn't have achieved that goal again.
And it's not only us, who's interested in creating a free Linux Kernel,
other major distributions see the problems, too. See for example the
recent comment by a Fedora
developer about changes in such a non-free firmware file. It just
seems, that Debian was one of the first to realise the problem of non-free
firmware files.
- Myth:
Debian is going down on it's knees before Stallman
Fact: I haven't talked with RMS about that, but I think Debian is still not
free enough for him; as far as I know, he would like to see the non-free
archive vanish completely, or at least not mentioned anywhere at all.
So, one question remains:
What is to bad about non-free firmware
files? Aren't they just some tiny programs executed in the CPU of the
device? Why care about them
Good question! Let's take possible legal
issues aside, and just look the practical side. The core problem is:
Without source (and tool chain to use the source) firmware files are just
some random numbers for us. We don't know what they are doing, we can't
analyse and improve them. We can't change them, we can't support them.
Maybe you already followed the link above to comment of the Fedora
developer. I cite him here again, because I think he summarized the
problem so well:
Updated qlogic 2400 and 2500 firmware to 5.03.13. What
does 5.03.13 do? No one knows, except for QLogic, and they're not telling.
I asked, and they told me that information was only available under NDA.
So, I encourage you to imagine what this firmware does, and the bugs it
fixes. While you're at it, imagine a world where vendors release source
code for their firmware.
So, now that we established the fact, that we can't support firmware
files, one could wonder, if we actually need to do so. What harm can a
simple, tiny program in a peripheral device do to your computer? Well,
scientist already managed to created
trojaned
firmwares for some
network cards. So it is a problem, and can even under some circumstanced
lead to security problems!
So, to summarise: Yes, Debian changed something in the Kernels. No, it
will continue to work as well as usual. Some users might need to enable
the non-free repository in their sources list, but those who won't, don't
have to. Firmware files needed during installation are also available, and
can be loaded by the installation system. So, what's all the fuss
about?
BTW: Those of you, who can't remember links very well, but fear, they
still might need the links to the non-free images and tarballs. just
remember two things: wiki and Firmware, as you'll find all
you need on the
Firmware page of
Debian's wiki.
as pointed out by