Bruce Perens: “Open Source Has Failed Its Users.”

Bruce Perens: “Open Source Has Failed Its Users.”

Bruce Perens has finally admitted that “Open Source has failed its users.” from the angle that users who expect to have Freedom from Open Source usually get no such thing at all.

Ever since the Open Source “movement” started, it has not been about the Freedom of the user at all.

The Free Software Movement is more than a decade and a half older, and Free Software is about protecting the Freedom of the user who gets a copy.

“Open Source” started out in the late 1990s to persuade businesses of a “superior method to develop software which works better, and you can even have free labor too”, and by the benchmarks that the movement itself set for itself, it has been a raging success.

Almost everyone on the planet today has some Open Source software, whether they realize it or not. It’s in Android, it’s in Mac OS, it’s in the iPhone, it’s in cars, it’s even in Windows, bits and pieces of this Open Source.

But these companies have packaged it, often, in ways where the user cannot run a different version of it, or at least not easily, and enjoy any sort of Freedom to improve on it, or to remove malicious features and replace it with a version of the program without the malicious feature.

What finally sent Bruce Perens off the edge?

IBM. IBM and Red Hat.

Today, Red Hat is owned by IBM and it is not at all like the Red Hat from 10 or 20 years ago. Today, we have a Red Hat that is a major parasite and a troll, and something that might as well be another Oracle, or another Google, or another Apple.

Whenever they “deal with” the GPL, they have lawyers on standby trying to figure out how to sabotage the GPL and make it effectively meaningless to the user.

The GNU General Public License was created as a Free Software License, to make sure that the user would always have the Freedom to use modified copies, to share the improvements in that copy, and to compile and run a different version of that copy.

Over the years, and especially culminating under IBM’s ownership and tenure of “Red Hat Enterprise Linux”, Red Hat has been doing increasingly nastier things with “their” Linux kernel.

They think that there’s some magic words that their lawyers can sprinkle into some other agreement that lets them retaliate against their customers for flexing their rights under the GPL, and most of their customers won’t dare to question this, much less sue Red Hat, which in my opinion, they definitely deserve for trying to pull this shit.

Over the years I’ve fought off some nasty companies who just figured they could throw a Linux kernel and some other stuff over the fence and walk off and refuse to hand over the source code. Probably the biggest one was Samsung, with a Blu Ray player, model BD-C5500, around 2009-2010.

I argued, as the Vizio lawsuit does now, that when they sold me one, they made a “contract” with me, that the GPL was a “contract” with the user, and that I wanted the source code or they’d better prepare to argue that it was not a contract.

No court has ruled on whether the GPL is or isn’t a contract. If the GPL is a contract, as they seem to be moving in the direction that it is, then every software license is a contract, and potentially any user can sue for the distributor’s failure to perform a thing under that contract.

This will not help “Open Source” users at all, because those licenses don’t involve the author or the distributor promising to do anything.

In the specific case of Samsung, I was able to get them to turn over the GPL/LGPL stuff in a ZIP file pretty quickly once I started down that road, but they should have just complied.

Thanks to “Open Source” software elsewhere that didn’t protect my Freedoms at all, there was still no way to study the code and run a different version on my player.

Companies hoard source code and violate licenses even when there is absolutely no practical benefit for them to do so. These companies, serial GPL violators, are usually just a “bag of dicks”. They’re usually not even trying to hide it because they can prevent you from doing something by hiding it.

Red Hat even falls into this category now, under IBM, as it pertains to trying to hide the kernel and call it “theirs” even though it is GPL-licensed. A “bag of dicks” that I believe are violating “the spirit of the license” even if what they are doing is legal.

The GNU GPL is Open Source, but it isn’t Open Source.

The goal of the GNU GPL is to give users the Freedom to do anything they want, as users. It meets the “Open Source Definition” by that measure, but it is a disservice to refer to it as an “Open Source license”. It is a “Free Software License”.

Open Source tends to degenerate into proprietary software that the user cannot actually do anything with except run, often almost immediately as soon as anyone else who finds it to be a handy program gets it and cobbles it into something else.

The GNU GPLv2 was released in 1991, when computer users faced different threats.

Most users of the PC were not faced with malicious software that controlled which operating system was allowed to boot. This malicious software that users face today is called “UEFI” and “Secure Boot”. On non-x86 systems, you frequently can’t turn it off at all and boot a different operating system, and on x86 systems, it’s only possible for legacy reasons which Microsoft is increasingly not supporting anymore at all.

It’s designed so that Microsoft can throw a switch later and force their partners to, and they can say “All ours now….All ours now.” about the PC and leave the user with no choices except whatever Microsoft allows.

And a lot of really terrible human beings have collaborated with Microsoft to “support” this system on the PC from the Linux side, and not only to support it, but to put a backdoor into the OS. This backdoor is even in Debian. The backdoor is called Linux Vendor Firmware Service.

LVFS “dials home” and uploads “blacklists” of things Microsoft doesn’t want you to have on your computer, and then sneaks these blacklists into your UEFI firmware, quietly.

In fact, you will only find out about LVFS doing this when it, like everything IBM and Microsoft have a hand in, breaks down and starts throwing weird indecipherable error messages.

I recommend purging LVFS out of the system and not giving the OS a network connection until it is gone.

The fact that this horseshit is even in Debian shows that Debian no longer meaningfully respects the user’s Freedom. It’s up to the user to know that Debian, even, is doing things behind their back and stop it.

Bruce Perens is right that Open Source has failed its users. Why has it failed? Money is a corrupting factor.

Microsoft and others have basically bought and bribed their way in. They pay generous salaries to people without any form of conscience to assist them in harming billions of computer users.

So what do we do about it?

Well, we will have to remain apprised of the situation. For now, do we have to panic and run for the fire escapes from the PC? No. There’s a very good chance that the computer you use right now will continue working for years, and all you should do to it is turn off “Secure Boot” and remove LVFS.

In the future, we’ll have to be much more careful to buy from PC vendors that include firmware that’s not a pile of garbage that hides bugs and locks you out calling itself “Security”. OEMs like System76 appear to be concerned about your Freedom as of the time of this writing, but as always, stay informed. Things can change.

The various “Pi” devices are cheap, and always getting faster. Each iteration gets multiples faster than the last one, and they can be built for between $100-150.

More work is being focused on emulating x86 for Wine, and at the rate the Pi systems are improving, they should be able to run the majority of Windows software, if not now, eventually. The faster the CPU, the less the dynamic binary translation even matters.

I personally, am going to use whatever keeps Microsoft’s operating system out of my life, even if it means not using the x86 PC anymore. The only thing Microsoft is bringing to computing anywhere they go is more viruses and data breaches.

Recently, the Lake County, Illinois Health Department had their second data breach this year, and third in the past two years. They implicated Microsoft in passing.

Microsoft is responsible for thousands of data breaches. Every scammer on the planet probably has your Social Security Number and other stuff because someone else paid Microsoft to do things for them.

Microsoft is an option for when you don’t give a damn about Security because it’s someone else who will suffer every time you get attacked.

And some of their victims, direct customers who do get attacked later and lose something keep going back, a lot of the time.

“Did Microsoft do this to you?”

“Yeah, but you gotta understand, deep down, they really love me!”

The kind of Nazis and morons that they hire to work at Azure, who brag about their drug binges and venereal disease and all the coworkers who should “be deported”, and how the Indian CEOs are ruining tech companies, who cap it off with a good stabbing on the Microsoft Campus, should have been your first clue.

We absolutely cannot depend upon proprietary software companies.

So instead of stewing on the fact that the “Open Source” people kind of suck because “Open Source” isn’t about Freedom, let’s move this in a more positive direction.

It’s unfortunate every time a software developer chooses to use an “Open Source” license instead of a “Free Software” one with copyleft features, because it means there’s another program out there where the freeloaders in the Fortune 500 can use gulag labor to build roads only they can benefit from, so to speak.

That library or that utility you release under the Open Source license instead of the Copyleft one, there might be an improved version floating around in Windows, Apple, or Android that only those companies can use.

They can quietly run off with it, not even tell you they used it at all, and then you find out that Intel has created an entire malware program designed to undermine the security of the user’s OS, out of your OS, like the MINIX incident.

Everyone with a post-2016 Intel computer is running an entire UNIX-like OS on the CPU, which is there to spy on them and act as a backdoor that is impossible for the user to remove and which the OS you see is unaware of, and cannot control.

MINIX is “Open Source”. Open Source means it’s only a matter of time before a program you release like this gets turned around and used to attack the user, or at the very least, by Tech Company jerks on the Left Coast, or maybe even a Communist regime, to harm people and benefit themselves at the expense of millions or billions.

Don’t be a promoter of “Open Source”. Be a promoter of “Free Software”. Make sure your users keep their rights no matter whose hands your program has passed through.

This is not to say that the GPLv2 is perfect. It is not. It is deprecated by the GPLv3, which was designed with more modern threats to the users in mind.

The only real opposition to GPLv3, are malicious entities that want to harm your users, and they have a lot of anti-GPL propaganda out there to try to discourage developers from choosing this license.

In the context of booting a computer, the whole “systemd-boot” setup is designed to replace GRUB2, in order to impose Microsoft’s “Secure Boot” malware on the user.

Microsoft refuses to directly sign anything under the GPLv3 because then they would have to tell you how to work around Secure Boot, so the current setup is using a program called “shim” to load GRUB.

Shim is a binary the user is not allowed to control, and it’s licensed under an “Open Source” license, which makes it easy to attack the user’s Freedom.

The problem with this setup is that it’s flakier. There’s no technical reason why GRUB2 can’t boot a PC directly. They’ve made the system crankier and more prone to weird failures purely to appease Microsoft and help them attack the user.

Open Source has “failed its users”. It was designed to, so it is doing what it was made to do.

Why You Shouldn’t Buy a Mac for Linux.

Why You Shouldn’t Buy a Mac for Linux.

Meanwhile, on the Fediverse, I found this.

Buy a Mac! Run Linux on the piece of shit! It’ll be FUN!

Just when I got done complaining about the Lenovo firmware garbage, with just two examples, Apple proves why they’re not a real option.

In the more serious of these two cases, they can’t even reliably update RecoveryOS, which is sort of like the “Recovery WIM” partition in Windows-land. It’s where you usually end up if your computer is fucked, and I think it can do some things to repair macOS or get a fresh copy on your computer by downloading one from Apple.

The trouble with Apple’s buggy software is that when they screw up RecoveryOS it’s no longer safe to install Asahi Linux, and it wouldn’t be able to recover macOS either, likely, and you’d have to just take it to an Apple store and hope they do something for you.

Maybe even charge you even though it was because of their bug.

There are many bugs in Apple products, especially their most recent releases, and a lot of these are firmware bugs. They’re in there using the “Apple Tax” on their shareholder dividends and marketing, and I really don’t think their computers are a lot higher quality than a Lenovo.

And it was these Asahi Linux people that were a major push for Rust support in the Linux kernel. Almost the only project using it much is to get Apple hardware working, when all of the effort is most likely futile anyway. Apple has gone from m68k, to ppc, to x86, to arm, and if they want to do it again they will.

They don’t support anything. Even when they were on x86, they pointlessly dropped 32-bit x86 application support for no reason. If you say something is the way to run programs, you ought to support it for decades unless it was simply so horrible it’s impossible to live with.

Apple didn’t have to do that to their Intel Mac customers, they just dropped it with no warning a few years ahead of getting off x86 because they’re Apple.

Things like this, and all of these ridiculous bugs, are why Apple computers will never be anything beyond a joke.

They pissed Ken Thompson (one of the inventors of UNIX, and C) off enough to just move from a Mac to Linux on a Raspberry Pi, and that’s before the RPi 5 came out with 4 times as much processing power, double the RAM, and better graphics.

Once you put Linux on a Mac, you’ve still got a bad computer.

The drivers are reverse engineered, and do not support the majority of Linux applications. They are particularly deficient in graphics, where you’re stuck with OpenGL ES.

Not even real OpenGL. Just a deprecated subset that might be useful for a dumb Android phone game. On a desktop, almost completely useless except maybe for desktop effects.

From my understanding, you don’t get real OpenGL, and you sure as Hell don’t get Vulkan. The hardware may not even support Vulkan.

In my testing with Intel Xe GPUs, the Vulkan renderers on games usually run in the ballpark of twice as fast as the OpenGL ones.

You couldn’t run really expect to run Yuzu, the Nintendo Switch emulator, on OpenGL ES on Linux on a Mac.

First off, they’d have to write a new renderer, then they’d have to port the program itself to the M series CPUs, and it’s a pretty tall order, and is likely to happen on some new RPi before a Mac ever becomes a viable development target.

Someone asked about Yuzu on a Mac with Linux, and the answer was “Port it yourself. There’s source code.” and that’s where the conversation stopped. I run Yuzu every day almost, on a 2020 Lenovo laptop.

People who develop Linux programs like these do it because they’re using hardware that is a development target. So when you buy a Mac to run Asahi, you’ve got something you can’t even use for use cases that someone might target Mac OS itself for.

Some people have asked about getting rid of the macOS entirely and running Linux as the only OS.

From what I’ve gathered from the developers, this is possible, but they strongly advise against it. You can’t update the Mac’s firmware without macOS, so they recommend resizing the macOS partition which means it’s wasting some of the disk even if you never boot into macOS for anything.

While not being able to update PC firmware after you get rid of Windows, this isn’t usually a big problem. If your computer’s in warranty to where the manufacturer has to support a fucked BIOS update or doing something so outrageous you can’t live with it, you update it once on the way out the door and generally never have to do it again. Linux will work.

On an “Apple Silicon” Mac, system firmware is a much much larger problem.

From the description of it I have from Asahi developers, I understand that you may be required to use macOS to update the Mac’s firmware (1) so that you can update Linux at all past a certain point, or (2) so you can use some feature (like more OpenGL ES features) at some future date, which may not be usable without a firmware update.

So you’ve basically got an expensive pet rock that’s even more of a nightmare to deal with than a PC. And in return, you get all these Apple bugs and less software.

When they don’t think PC users are listening, the Mac heads bitch and moan about bad design that’s pissing them off. Even JWZ does it, but for some reason thinks Linux is stuck with the same issues he experienced in 2008.

The Mac is, sadly, not an option for Linux. If anything, it is polluting and bloating Linux with a meme language that people are using to write garbage with, and that could metastasize and become a problem for Linux later on.

This is why I briefly considered buying a Mac and then talked myself out of it. You’ll never actually free it from the really awful OS it came with like you can with a PC, it’s ungodly expensive, and it’s got more laughable Linux support than a $100 RPi 5 computer I can buy at an electronics store in Chicago.

What’s unbelievable, to me, is how much Apple has regressed from the point my editor, Howard, was sending me “Mac-formatted” floppies in the late 90s, and that people want to use Linux on this.

Linus Torvalds on the Lenovo UEFI Bugs. “When You Can’t Trust Kernel Updates, People Will Stop Updating the Kernel.”

“One thing I find myself wondering about is whether we shouldn’t try and make the “ACPI” extensions somehow Windows specific.

It seems unfortunate if we do this work and get our partners to do the work and the result is that Linux works great without having to do the work.

Maybe there is no way Io avoid this problem but it does bother me. Maybe we could define the APIs so that they work well with NT and not the others even if they are open.

Or maybe we could patent something related to this.

-Bill Gates, 1999

Linus Torvalds on the Lenovo UEFI Bugs. “When You Can’t Trust Kernel Updates, People Will Stop Updating the Kernel.”

In my post yesterday, I mentioned the nightmare that’s going on in Lenovo laptops from the last 3-4 years due to a Chinese developer at Loongson bumbling around in some really hacky ACPI (power management and device info) code in the Linux kernel.

Let’s face it, Lenovo is never not a nightmare.

They’re so filthy and corrupt, and they put such cheap shit (keyboards are always a problem after a few years in my observation, I also had to have them replace the entire mainboard in this laptop when it was less than a year old due to USB port malfunctions), that they’re always being sued for SOMETHING even if it isn’t Linux-related.

Like the Superfish malware they pre-installed to get ad money on some computers, or the time they abused a Windows anti-theft feature by having a BIOS that re-installed all the OEM “crapware” every time a user uninstalled it, or for a different adware incident where they ended up paying me some money, or all of their defective laptop monitors (which you can still claim money from if you have those systems.)

ACPI, though, is a Microsoft standard that started out in the 90s.

From the beginning, Bill Gates (who presided over Microsoft during its high water mark of making money through criminal activities) was E-Mailing people at Microsoft trying to figure out how they could make the ACPI standard so bad that it was either Windows-only or at least difficult to get working right in a competently-designed OS.

So it is not the fault of Linux that the PC has so many problems.

Most of the actual, worst, parts of the PC’s Legacy BIOS. The parts, like ACPI, which have brought so much swearing and cursing from users when their computers don’t work, was hashed out by Microsoft, and for the purpose of deliberately bricking non-Windows systems, or at least to cause annoying malfunctions.

Then, because re-writing things costs money, this crap was basically copied and pasted, verbatim, into the even bigger PC firmware trash fire, called UEFI.

As bad as ACPI in general is, it’s more of a problem with some manufacturers, mainly ones that use a particularly heinous supplier of UEFI firmware. (Lenovo tends to use Insyde.)

The ACPI code in the Linux kernel is some of the worst code because it deals with some of the worst firmware, PC firmware.

Microsoft designed it to sabotage other systems to maintain a Windows monopoly.

So Torvalds was right when he says if you do something to fix one thing, it often breaks something else. It’s pissing him off, it’s pissing me off. I’d imagine that it pisses off anyone who is not in Microsoft’s orbit, to be honest.

And it’s why I’ll either buy a System76 x86 laptop next time, with open source firmware, that isn’t some binary blob designed by Lenovo, a Chinese company that only barely tests to see if Windows boots and then calls it, or just start over with something like the 8 GB RAM Raspberry Pi 5 with Linux on some flash memory.

(Check your Windows system logs sometime if you have a typical Lenovo system. The firmware certainly isn’t harmless even on Windows. It fills the logs with errors, Windows hides them. It’s a fantastic arrangement they have.)

I’m smart enough to make an RPi 5 work, and they only set you back about $100-ish plus maybe some peripheral expenses. It’s not a hole in the bank account like some $1,000 lulzy laptop made out of Chinesium.

(I do wonder whether ZStd or lzo-rle would be the way to go for the ZRam device though. You’d definitely want the fastest algorithm for a compressed RAM device on a Pi 5 even if it is 4-5 times as fast as the Pi 4. So far, the only things going for an x86 PC are compatibility with proprietary Windows software in Wine, Steam for some people, and the fact that Windows coming with it made it bog standard for cheap mass produced garbage to throw Linux on, until now anyway.)

Linus Torvalds brought up a good point though. Even though these ACPI disasters are not the fault of Linux, he’s also not allowed to do interviews and bring this to public attention.

Linus Torvalds can’t tell you how pissed he is at this, because the Microsoft-controlled (buying influence and voting seats, along with partners) “Linux Foundation” is his paycheck.

Abuse has historically been hurled at Linus by criminals, monsters, and mobsters.

Sometimes abuse comes from incompetent fucktards who may not be criminals, but they’re at least doing bad work. Often from IBM/Red Hat (related to systemd and the idea to put dbus in the Linux kernel, among their other greatest hits), which kept bringing him bad code and even worse ideas.

I could see why Red Hat wanted dbus in the kernel. I really can. If it’s in the kernel, it makes the problem everyone’s problem. They were also hoping to lob it in there like a grenade without fixing any of their bugs, like random disconnects from the bus, and then run away without fixing anything. A drive-by dbus-ing.

These types of toxic people were the reason Linus was forced into “therapy” to keep his job (on a project he started), but although he can’t be as straightforward as he once was, he did at least let on that he’s badly annoyed that if things like the Lenovo incidents keep occurring nobody will trust kernel updates.

And he’s right.

Fedora once broke power management on my 2016 Yoga 900 ISK2 for over 3 months when Intel turned it off to investigate a security hole in their graphics card. Then they turned it back on without ever fixing that hole three months later. I had to version lock an older kernel with DNF and let dozens of much more serious CVEs pile up.

My mistake was that it was easier to keep Fedora then and do that than undertake the transition away from Fedora, which I eventually did years later because they’re in such a bad shape now that they’re ruining the distribution by dropping packages, making incompetent design decisions, and can’t even manage a release anymore without multiple delays.

Now that I am on Debian 12 and Linux 6.1 LTS will just keep getting bug fix backports indefinitely from upstream, this laptop is going to use Linux 6.1 until Debian 12 doesn’t work anymore or the hardware konks out.

I’m done pulling in major component updates that nobody can support because they don’t know what my exact computer will do when they get them. If I wanted broken shit every month, I could just grab the Windows 11 ISO and install that.

Thankfully, Debian has long term releases. They do what they do the day you install them, and it probably just gets better later on because it’s low risk stability patches and security patches.

Some people have chided me and say I should be using something even “edgier” than Fedora, like Manjaro. They claim that with little or no testing, I can just deploy what someone managed to run through a compiler yesterday that has thousands of major changes, deploy it, and it will never ever break down on me.

No thank you. You’re basically throwing darts at a board and hoping they at least land somewhere on the board when you run a distribution that doesn’t commit to conservative, semi-frozen releases, that are supported for years.

Debian 12 doesn’t have to be completely stuffy.

There are ways to target and backport individual releases of newer software to it.

Even Mozilla figured out the other day how to run an Apt repository, apparently, after a tradition that ran back to Netscape Navigator of putting it in a tarball and saying “Linux”. *slow claps*

There’s Flatpaks, there’s Debian Backports.

I’ve found out, at some great burden on myself, that it’s better to learn how to administer Debian than get something like Fedora installed really quickly by slapping “next” a bunch of times and then finding out that you “passed it to find out what’s in it”, as former House Speaker Nancy Pelosi put it with Obamacare.

In America, Congress passes gigantic bills in the middle of the night which contain 3,000 pages of new laws, which no voting member has even read, then you need hundreds of pages of “trailer bills” to fix the mistakes and the stuff that nobody even knew was there.

Then there are court cases to determine what Congress even meant because they used the wrong words in a draft and it made it into the law, and someone thinks they can bring the law down because of a draft error.

While all this is playing out, they’ve done 100 more laws just like that one.

That’s sort of what trying to deal with a distribution that’s constantly bringing new software in is like. Problems come and go. There’s no time to even figure out what’s gone wrong and where at.

The cost of slapping next a bunch of times and having a “system that functions” is that it will turn out to not function especially well for anyone.

They have to kind of guess what a core user will want to do, and they can guess wrong.

Every decision they make can either bloat or leave something out of a “live installer”, or make a setting that works for some people, and not so well for others.

Lately, Fedora has been a really big WTF for me. First they drop LibreOffice, which I need, because that’s what IBM demanded. Then they put in a systemd-oomd that kills browser tabs when you have a ton of free memory.

Now they can’t even figure out how to make a release without at least a two week delay, and they say maybe they’ll just give up fixing the blockers and cut an ISO.

Fedora has always been an uneven distribution, but now I don’t even trust it on a laptop I mainly use 10 applications on.

Again, it comes back to making changes to the kernel, and sending them out if they compile at all. I’ve had problems with Fedora I haven’t had with any longterm distribution, ever, including “upgrade your kernel and get a panic in the Ext4 driver”.

There is a very real risk that marking things stable and compiling them without anyone really checking what’s going on, people won’t trust kernel updates anymore.

Many of these problems are happening upstream because nobody checks the work of companies like Intel. They’ve been given a license to talk in something rather like “Fedspeak” and not document what their code really does, and there’s a very “laissez faire, laissez passer“, or let them do whatever they want, with companies and their driver code. So by far, the thing that scares me the most about upgrading the kernel is not core code.

It’s the x86 branch, especially ACPI, and the drivers, from some hardware makers more than others.

I’ve been around Linux long enough that unlike some of the critics of Techrights, I know how to use git on my computer and I once spent years with my own kernel series because I got so fed up with my distributions taking forever and packaging some rather awful releases. When you own the fork, the patchset, the compile time options and compiler, you get to manage things. My kernels almost always worked better for me than the ones the distributions made.

There are lots of reasons, from slimming them down, to turning off a bunch of really godawful shit that is useful to almost nobody that makes the entire thing flakier, to making sure you’re pulling the latest features in the hardware drivers into a kernel series you know isn’t bad.

Many of the people arguing that Microsoft has become a new company that likes Linux are either sockpuppets, or really are so stupid that they don’t realize that the kind of shit Microsoft does to the PC now is a million times worse than trying to deal with a PC 20 years ago.

Maybe, hopefully, some of these people ran Arch or something and yanked in a broken kernel and got a taste of what I’ve been going through for years.

*takes a sip of coffee* Told you so.

Debian 12 keeps updating Linux 6.1 LTS, so I really don’t know what later kernels are doing on this hardware, and I don’t care, as this is the most unbroken stretch I’ve had with a computer that was not doing something ridiculous.

The “pass it to find out what’s in it” approach is a bad way to run a country, and it’s a bad way to even run some laptops.

The PC situation is rapidly becoming untenable. It’s possible that it could fall apart completely on a technical level long before Microsoft has a chance to try to mitigate further erosion of the Windows operating system by making it impossible to turn “Secure Boot” off.

The only reason they ever gave you that switch was because the state of the PC industry in the Windows 8 era meant that some hardware needed Legacy Boot (BIOS compatibility mode) and there were people with downgrade rights to Windows 7.

BIOS mode is gone and Windows 7 is out of support. Time’s almost up.

Bad Lenovo UEFI Firmware Causes Nine Models to Freeze on Resume from Suspend. Delays Linux 6.6.

Bad Lenovo UEFI Firmware Causes Nine Models to Freeze on Resume from Suspend. Delays Linux 6.6.

I don’t even want to write about Lenovo again in my life, since they are such a nasty company, but Roy asked me to say something.

Ever since 2016 when they admitted to me that there was a deal with Microsoft to lock Linux out of the Yoga 900 ISK2, but then proceeded to defame me after the media reported on a Reddit post I made on the subject that went viral, and then quietly fixed it after I took legal action against them, I’ve been telling people what a super shitty company they are.

Lenovo is a Chinese company, so it probably shouldn’t come as any shock that they banned everyone in the State that I live in from commenting on their forum until the scandal died down.

In China, when someone is talking, you typically figure out abhorrent ways to stop them from talking, which don’t work in a Free country. For Lenovo, really all they could do was try to silence people on their own support forum, but by then it was too late.

They also indiscriminately banned anyone who talked about “hacking” the board with an external flasher to unhide the “ACPI” option (to allow other operating systems to see the storage device), which was always present, but hidden as per their illegal contract with Microsoft, which they quickly got scrapped after the State of Illinois started investigating them.

The late 2020 Tiger Lake-based ThinkBook 15 I have is a little better.

Lenovo’s advice was to disable “Secure Boot”, as all it has ever done for Linux is cause problems due to extra complexity and bugs, as it is a Microsoft requirement to license Windows to OEMs, which is the default state of the laptop. “Secure Boot” actually does nothing to secure the computer from most any actual security threat that anyone really faces.

In at least one case, on my Yoga 900 ISK2, Ubuntu updated the “Secure Boot” dbx due to “Boothole”, and the revocation update (dbx) caused Fedora to fail to boot with a “Security policy violation.”

To unjam it I had to reset “Secure Boot” to the factory settings and that apparently wiped the dbx update. At that point I turned “Secure Boot” off and have never turned it on after removing Windows from a PC since then.

Lenovo’s other advice for this laptop, even though the “fake RAID” support was added to Linux after the 2016 incident by Intel (after they refused to document it for over a year!), is to turn that off and set the disk controller to “AHCI”.

Matthew Garrett claimed that this had something to do with power management, but he was either wrong or lying, because when I run powertop as a system service (to set all power management tunables to on), I always get better battery life than Windows does.

He’s very obtuse, and it’s probably because his job at various points in time involved implementing Microsoft nonsense like “Secure Boot” in Linux.

They need to get rid of the “Free Software Award” because they have such a bad habit of giving it to the wrong people.

(It’s like watching Donald Trump putting the Presidential Medal of Freedom on people at this point.)

Other than a bunch of “FIRMWARE BUG” crap on my 2020 Lenovo laptop that prints to the screen (which Windows and IBM Fedora hides, but Debian doesn’t), the laptop works fine with Linux.

But Lenovo released, apparently, more than nine models of AMD-based laptops with UEFI bugs that prevent the user from resuming from suspend due to fatal ACPI errors, which includes the AMD option for the laptop model I’m writing this on.

Although, mine’s an Intel, so in your face to all those “AMD is better” people. 🙂

The Linux kernel’s 6.6 release was delayed while workarounds that added 78 more lines of firmware bug workarounds was added.

Linus Torvalds was obviously furious, but criminals and idiots put him in therapy for yelling at them with incompetent code in the past, and he put Linux under the control of a now Microsoft-controlled “Linux Foundation” and so to keep his job, he can’t say much anymore.

According to Roy Schestowitz, the culprit was something that a Chinese man exhaling some sort of smoke (to look macho I guess?) on his Microsoft GitHub page did in the ACPI code in the Linux kernel.

Apparently, his name is Huacai Chen and he works at Loongson.

Linus Torvalds very obviously wanted to scream at him (backscroll and read down) for moving ACPI code around to fix something and then breaking other things, then hiding that they were broken until users started writing in saying they upgraded their kernel, some stuff happened, and kersplat.

I don’t even plan to stay on the PC after this laptop unless I decide to buy a model with open source firmware from System76 instead of this Lenovo garbage which is barely even code.

UEFI is garbage, Microsoft is garbage, Lenovo is fucking garbaaaage. The entire PC situation is cat shit wrapped in dog shit. And the people working on things like “Secure Boot in Linux” just make it so much worse from there.

This is the worst time to own a x86 PC, EVER.

Lenovo has never supported updating your UEFI firmware on most of their products using anything available to Linux users, even LVFS, which is a backdoor, and I wouldn’t trust them not to brick my computer or make it worse if they did.

I uninstalled LVFS because it started spitting an error message into Debian. It’s in charge of updating the dbx, but fuck dbx, fuck “Secure Boot” (which makes it harder to plug actual security holes), fuck Microsoft, and fuck the people Microsoft gets to make this my problem.

As a user, I just think these things are deplorable, but large corporations have turned Linux into some shitty colony where they can put DRM malware, universal backdoors, and absolutely broken shit with no repercussions. None. Not even that Linus Torvalds might yell at them.

So the last time the UEFI in my ThinkBook 15 was updated was August 2021, when I switched it over to Linux.

By that point, they had fixed most of the really nasty bugs they shipped the laptop with, which were even causing problems in Windows, but as firmware upgrades are dangerous and I have no warranty now, and they require Windows, I don’t plan to touch the firmware on this laptop ever again.

It’s just not worth it. One of the bigger problems with UEFI is that it’s just such a monster that you can keep fixing bugs forever, and that’s why “Secure Boot” will never work even if they wanted it to.

If you could get past the issues like “This is barely even code. It’s just a pile of garbage.”, the x86 PC might be worth plodding along with.

Now that they make the Raspberry Pi 5, and it’s several times faster than its predecessor, I wonder why we’re even talking about sticking around for more abuse.

When the UEFI firmware Lenovo ships is so fragile that a guy working for a hardware company making totally unrelated MIPS processors in China bumps something and an x86 Lenovo laptop that people bought THREE GODDAMN YEARS AGO starts malfunctioning if anyone installs that kernel, it’s time to look for greener fields.

UEFI is such a catastrophe, that it’s not even just a Freedom issue.

It’s such a massive fucking colossal failure on a code level that Google, which certainly doesn’t care about your Freedom, based the Chromebook firmware on a variation of Coreboot.

My next system will probably just be Linux running off some cheap flash memory on a ~$80 ARM computer. The fact that the Pi 5 finally has a SKU with 8 GB RAM really REALLY helps. With the help of ZStandard compressed ZRam, you can make KDE work with this.

No more of these $1,000 Lenovo PC laptops full of LULZ for firmware and Chinesium keyboards where buttons randomly break and need to be remapped to another key because they’re three years old, and playing “How do I brutally murder Windows 11 this time? Hmm…. DIE DIE DIE!!!!!”

Valve Threatens Users on Windows 7 and 8: “Upgrade or Lose What You Already Have”

Valve Threatens Users on Windows 7 and 8: “Upgrade or Lose What You Already Have“

In another example of “forced upgrades by way of arson”, like Mozilla does to users hanging out on old versions of Windows that even sort of worked, Valve will be discontinuing support for Windows 7, 8, and 8.1 because it relies on an integrated Google Chrome (barf) browser.

Users have until January to get away from these operating systems before what they’re already doing stops working, taking out all their games.

They should move to Linux, which is free, or a Steam Deck which also runs Linux (and KDE) and bring their Steam library over that way.

Eventually, Firefox 115 ESR will be out of support and then the browser will degrade and pile up unpatched security holes.

There’s no telling how long an existing computer from the Windows 7/8 era will run Linux, but it beats these Windows “upgrades by arson”, which often need a brand new PC just to run Windows, and which are probably only somewhat better (and less frequent) than Apple not being able to decide which processors they’ll use or APIs that will be supported. 🙂

Windows 7 and Windows 8 Support

As of January 1 2024, Steam will officially stop supporting the Windows 7, Windows 8 and Windows 8.1 operating systems. After that date, the Steam Client will no longer run on those versions of Windows. In order to continue running Steam and any games or other products purchased through Steam, users will need to update to a more recent version of Windows.

This change is required as core features in Steam rely on an embedded version of Google Chrome, which no longer functions on older versions of Windows. In addition, future versions of Steam will require Windows feature and security updates only present in Windows 10 and above.

Although support won’t end until 2024, we strongly encourage all Windows 7/8/8.1 users to update sooner rather than later. Microsoft ended security updates and technical support for Windows 7 in January 2020 and for Windows 8.1 in January 2023. Computers running these operating systems, when connected to the internet, are susceptible to new malware and other exploits which will not be patched. That malware can cause your PC, Steam and games to perform poorly or crash. That malware can also be used to steal the credentials for your Steam account or other services.

-Valve

Microsoft Larabel at Moronix Posts About More X11 “Security Vulnerabilities”.

And now for a bad lip reading regarding the latest “X11 security incident”.

“Hello, I have been using Google Chrome on my multi-CRT setup on a computer from 1999. I am very concerned that attack code will try to exploit a use after free in Xvfb while I use Zaphod heads.”

“May I speak to the manager?”

😀

I’m honestly surprised that anyone is even looking for bugs that are this uninteresting.

No doubt, if they are found they should be fixed. Again, the fixes are not a dramatic overhaul of anything. They boil down to a few lines of code being altered.

I do have to wonder why Trend Micro (a Windows “security” huckster) is looking for crap like this in X11.

Maybe so that “news” sites like Moronix can continue posting about “Linux security problems”.

Microsoft likes this. They benefit from the misdirection.

Microsoft is obviously paying some sites to ham it up as a distraction from constant actual Windows and Azure data breaches where people make off with everything from your banking and healthcare data, to things that are impossible to fix, like your Social Security numbers and credit files.

The realfact (I’m a realfact kind of guy.) shows that Microsoft is too dangerous to actually use or trust anywhere that data security is actually important.

Quite often these “Linux bugs” are not bugs in Linux itself, but rather anything “open source”, often stuff that’s widely used on Windows, or even a part of Windows, or in the “Corrupted Linux” called WSL, which they have extended like the Microsoft Java VM, so they’re not even Linux programs anymore if you build them that way.

The fact that “security researchers” keep finding so many bugs that are only barely important tells me that someone has an agenda. Who pays people to sit down and find trivialities? I wonder.

What to do about these X11 bugs?

Well Debian has already issued an updated set of Xorg packages. Just install them and restart X11. Big whoop.

Honestly, it’s hard to tell how this would even be exploitable, but you should always patch things ASAP.

The same media going on about this doesn’t ever talk about 30-40 emergency vulnerabilities every month in Microsoft Edge, Google Chrome, or Firefox.

Microsoft Security Theater Boot Forces Unnecessary Steps to Mitigate GNU C Library Vulnerability.

Microsoft Security Theater Boot Forces Unnecessary Steps to Mitigate GNU C Library Vulnerability.

According to Red Hat, Microsoft “Secure Boot” can actually stop you from installing a mitigation for a Severe CVE called “Looney Tunables” (CVE-2023-4911) in glibc, which Red Hat released for those who can’t patch glibc for some reason.

If you just try to load the systemtap module without screwing around with “Security Theater Boot”, your computer will fail to boot with a “security policy violation” message from your UEFI firmware.

Irony!!!!!

Here’s the original. Also, Archive Today in case IBM tries to remove this later.

If Secure Boot is enabled on a system, the SystemTap module must be signed. An external compiling server can be used to sign the generated kernel module with a key enrolled into the kernel’s keyring or starting with SystemTap 4.7 you can sign a module without a compile server. See further information here – https://www.redhat.com/sysadmin/secure-boot-systemtap

-IBM Red Hat

Of course, Security Theater Boot continues to provide no advantages, and now it actively makes securing your computer more difficult because it will block a mitigation as “unsigned module”.

We really don’t need much more evidence that Security Theater Boot and the people who implemented it on Linux are not friends of Free Software (as it is designed to put Microsoft in control of whether your operating system is allowed to load, which can be revoked later, even with a backdoor like Linux Vendor Firmware Service twinking unauthorized modifications to your UEFI dbx into your computer behind your back, unless you uninstall it), but this post should make it more obvious what the score is.

My advice? Continues to be kill LVFS, disable “Secure Boot” in the firmware, then uninstall mokutil and shim, and update grub.

Then you don’t need anyone’s permission to modify your operating system.

Which is how it should be.

Canonical Puts Homophobic Translations Into Ubuntu Installer After Snap Store Malware Incidents; Says Security of Products is “Very Important”.

Canonical Puts Homophobic Translations Into Ubuntu Installer After Snap Store Malware Incidents; Says Security of Products is “Very Important”.

Not long after yet another round of malware in the Ubuntu Snap Store, Microsoft-partner Canonical got caught with their pants down again.

Ubuntu 23.10, the Mantic Minotaur, had to be yanked back down, after Canonical released ISO installer images containing a malicious Ukrainian translation full of “teenage boy” style homophobic slurs and hate speech.

Canonical released two statements. One was on X/Twitter, the famously progressive and Social Justice Diversity Equality Inclusion site ran by Elon Musk that the libtards love. *giggles* (I’m, of course, messing with you. The guy allows Nazis and why is Canonical on X, I wonder. Maybe ask them?)

And the other, on their site. Where they say security is “very important” and leave an E-Mail address where you can contact them regarding any disasters you find in their products.

At this point, you know, you really have to wonder how careful Canonical really is about what goes into their distribution.

If they can’t secure the Snap Store and can’t even be bothered to run the translations back into English using cut and paste into Google Translate, how much effort are they really putting into Ubuntu these days, and why would I want to use it?

Their Snap system is so poorly designed that as long as it is in the distribution, I will never touch Ubuntu.

I don’t even recommend Linux Mint to people, except to tell them about Linux Mint Debian Edition, which just had LMDE 6 go out recently, based on Debian 12.

Debian is a much more stable and secure Linux distribution, and they don’t rely on marketing bullshit and gimmicks, like the Snap store. It actually uses and recommends its own packaging system and they seem to be careful about what goes into it.

Debian must be doing something right because so many hundreds of “other distributions” start out with Debian and then layer the actual goals of that distribution on Debian, since Debian already has done all the grunt work for them.

When Ubuntu started out, it was pitched as “an easy way to actually get Debian installed”, and when I evaluated it, it was.

In the early days, they did a lot of good work to actually improve on the problems that Debian, and Linux, were having, including a bad setup program, lack of “good defaults” for each role, and an aging init system that was having trouble going on.

Over the years, they’ve abandoned all efforts at actually improving the Linux desktop experience.

They’ve signed a deal with Microsoft to promote malicious “cloud” disservices and proprietary software, through a malware-addled App Store, replaced some of their own technologies that were quite good (such as Upstart) with IBM-isms that are full of bugs (systemd) or, frankly, are such an embarrassment that they’re squarely into “You cannot be serious.” territory (like Wayland).

They’ve brought in the worst Linux desktop they possibly could have gotten their hands on, which is GNOME, where nobody cares about bugs and people do a lot of work to scrap important features and even more work to contain the security fallout of features which actually should be deleted.

(The patch to try to plug the hole in the sandbox that the security researcher didn’t even notice he’d escaped from is several hundred lines of additional code in GNOME.)

At this point, Ubuntu needs to be completely rebooted, including dropping GNOME and Snaps, and putting KDE in as the default desktop.

None of which will happen. They’ve shown that they’re as disinterested in a stable and usable desktop experience as IBM is, and even less concerned with security.

This latest embarrassment is just frosting for the “I told you so.” cake, regarding Ubuntu.

That they cannot be bothered to even do a cursory check on translations should tell you what’s going on in there.

None of the news sites are telling people where to find the offensive translations so they can see what Canonical allowed in, so I will.

They’re on Microsoft GitHub, at least at the time of this writing. But also, backed up on Archive Today.

The malicious translations seem to start on Line 455.

If you don’t want to be offended, I suggest not reading or translating any of the Ukrainan text in this file.

There was a lot of stuff about systemd that I won’t repeat here.

-Reddit User

I actually laughed at some of it, including the parts where whoever did this compared encrypting your disk using the “Trusted Platform Module” with a “complete infection with Syphilis”.

You can’t trust corporations to manage anything. I’m not laughing at the majority of what they actually put in there, I’m laughing that the idiots running Canonical didn’t even notice.

Ubuntu has spent years turning into useless corporate trash.

It’s the Linux version of Windows. Just, basically, run.

GNOME Patches One Click Remote Code Execution Vulnerability in Tracker Indexer. Update on Code of Conduct Ticket Regarding Fedora.

GNOME Patches One Click Remote Code Execution Vulnerability in Tracker Indexer.

GNOME has a component called Tracker. It’s basically a search indexer. These are nothing new. Many operating systems and desktop environments have had them over the years.

You might remember the “Indexing Service” in Windows XP and how it would cause your hard disk drive to grind and thrash, and it didn’t even make searches that much faster.

GNOME’s Tracker Indexer is pretty awful too. In fact, when I had GNOME, I turned it off.

Every once in a while, for me at least, on Fedora, it would find a file that it didn’t like, crash, and put a core dump in my systemd journal.

Rather than report a bug that would probably never be fixed and would just get me some fresh abuse by GNOME/Red Hat/IBM assholes, I just removed tracker somehow. I can’t remember how I did it now. Maybe I just disabled it.

Most of the time it would index .opus music files okay, but then it would find one it crashed on. Anyway, it solves the problem on my end to just turn the thing that’s totally useless and full of bugs and lulz off, right?

When you use GNOME and Fedora, you quickly find that you’re pissing into the wind if you even try to report a bug. Then you don’t bother to. Then when something breaks, you just deploy a kludge that works for you.

Well, this time, someone found a way to get it to run arbitrary code by tricking the user into dropping a .cue file into their home directory. Whoops.

Here’s a link directly to the blog post, archived by Archive Today to avoid a link to Microsoft GitHub.

The main problem is a bug in libcue, but also in the way GNOME incompetently sandboxed Tracker itself, which led to a sandbox escape. The sandbox escape problem fixes the part where the exploit works just by dropping a file anywhere on the system.

This is really more GNOME’s fault than it is libcue’s because while this bug is in libcue, it would be far less dangerous without an Indexer running on the file system, and since the sandbox wasn’t really working, there’s no telling what else Tracker might be baited into indexing as well, and running arbitrary code with something else. Maybe in an even worse context than the libcue vulnerability.

GNOME is so bad in so many ways (code, user interface, people maintaining it) that it makes me embarrassed that I even have to qualify “Use Linux, but you should probably avoid GNOME unless you like a lot of weirdness and bugs.”

Most people have gotten rid of rotational storage years ago. What is, even, the point of something like Tracker and all of the potential attack code, on SSDs?

“Soon you will all see things that are more terrible than you could possibly imagine! Well, maybe not THAT terrible, but still pretty bad.”

Since more and more GNOME code is getting pretty bad, and since less and less people have any inclination or qualifications to fix it, and their usual answer to problems they don’t know how to fix is just deleting the entire feature (very soon to include the entire X11 session), I gave up on GNOME completely around the same time as the Walter Francis/Khaytsus incident on IRC.

Since I had to nuke Fedora anyway to get away from these people, and the fact that IBM is dropping packages and disinvesting from the desktop environment, and has become an Enemy of Free Software (promoting Microsoft Office, as well as the separate issue of hiding GPL-licensed source code in their Red Hat Enterprise Linux product), I ended up, ultimately, on Debian 12 with KDE.

I just had the 12.2 updates roll in with no drama.

I recently got an update after several months of nothing on the Code of Conduct violation for Mr. Francis.

jflory7 added a new comment to an issue you are following:
“Hi @baronhk, the Fedora Code of Conduct Committee reviewed this report and agreed this behavior is not acceptable under the Fedora Code of Conduct. The person was issued a warning. Any further violations will result in escalated consequence.

Thanks for bringing this to our attention. If this person continues this behavior, please open a new Code of Conduct ticket and bring it to our attention.

-From the E-Mail Update

Well, that’s nice. They wait until things die down and tell me that Walter violated the CoC and will not be punished.

Meanwhile, nobody ever ruled that I was the reason that happened, and I still can’t participate in the alleged Fedora Community.

This is how Codes of Conduct actually work. You get banned without anyone making a formal complaint and there’s nowhere to even turn to. Someone makes a formal complaint about someone important and they’ll “talk to him” several months later.

It’s still important to call them out. Theoretically if he keeps openly trolling people, they’ll eventually do something about him. If anyone deserves to get Kevin Kofler’d (who got banned from Fedora’s KDE sig by people who use Macs and Windows), it’s Walter.

Microsoft, Tens of Thousands of Layoffs Later, Can’t Afford to Maintain Windows. Out Go the “Legacy” Components.

Microsoft, Tens of Thousands of Layoffs Later, Can’t Afford to Maintain Windows. Out Go the “Legacy” Components.

Microsoft is unable to tend to Windows anymore after the layoffs and lots of failed acquisitions of unprofitable albatross companies and products, so it starts dropping more “Legacy” components that are the sole reason why anyone is still using this disaster in 2023.

Today it was announced that VBScript is the latest thing that will be tossed “in a future Windows release”. People who are using Windows have no choice about what components get dropped, unsupported, and are unusable, unless they want to brick the update system entirely and get no security updates.

Also coming, is Wordpad being dropped. Microsoft says “go use the clown”, however at least one person on Paul Thurrott’s “SuperSite for Windows” was pretty upset because he says that sometimes a Microsoft “OOXML” document will get so corrupt that nothing but Wordpad can fix it, not even the “.docx repair tool” in Microsoft Word.

OOXML is a horrible format. Microsoft claimed it was an “ISO standard” after bribes and corruptions, but then they immediately violated their own (purchased) “standard” and have spent nearly 20 years not complying with their own “standard”.

Windows is a dying platform and it’s very clear that Microsoft is no longer interested in tending to it. The first thing to get yanked out will be “legacy solutions” that people still use. Next will come announcements that will piss more and more people off and make them wonder why they’re even claiming Windows is backwards compatible with itself.

A statement that is becoming even more outrageously false every day.

VBScript was introduced into Internet Explorer in the mid 90s.

It was an attempt by Microsoft to “NIH” JavaScript, because they wanted to purge the Web of all things Netscape, in ways petty (like renaming Secure Sockets Layer to TLS) and big (competing with JavaScript).

VBScript, like most Microsoft “technologies” was designed to “gain marketshare” and “make development easy”, not to be secure, so it was no surprise when .vbs became synonymous with a computer virus, many of which spread through E-Mail attachments.

At the time, I was a teenager and I started calling it the “Virus Script language”.

The Register is very very apologetic to Microsoft. It says that it “unfortunately” didn’t displace JavaScript. On top of all the other horrors of VBScript, it was Windows-only.

Imagine a Web today full of ActiveX controls, Silverlight, WMA/WMV, and VBS. Yuck.

Their entire goal with this junk was to hijack the Web and make it a Windows program, and carpet bomb everyone with Internet Explorer to do it.

They went to OEMs and told them if they loaded Linux, BeOS, or another Web browser on your computer, their Windows license costs would nearly double, so nobody did.

The result was a catastrophe that went on for years, but made Microsoft a lot of money.

Today we have a lot of other options, thankfully. It was very ironic to see “Satan Nadella” testifying about Google locking people into Google search to get the Play Store, and how the Android devices are all-but-useless without Google Play.

Microsoft has always behaved like this. There’s documented evidence of them behaving like this NOW. I have taken action against Lenovo to over this, and won.

Microsoft hasn’t changed much at all, but they’ve put out different press releases.

Fortunately, with tens of thousands of layoffs that are still ongoing, and unbolting components that people are too lazy to replace otherwise, Microsoft is signing their own death warrant.

If they can’t afford WordPad anymore, hopefully soon they’ll stop being able to afford to bribe and corrupt open source institutions.