New BootHole Vulnerability Affects Billions of Devices, Compromises GRUB2 Boot-loader

[bug]

OK, but I also mentioned OpenBSD that was saved only by Microsoft coming along with $100,000 in their pockets.

The problem that most open source projects have is that they have lot of "takers" but not a lot of "givers". If you like an open source program/project, you need to do what is right and by that, I mean donate to the project be it direct donations or if they have a merch store, buy something there. Buy a coffee cup or a t-shirt for God's sake! Every little bit helps.

Like it or not, open source projects live and die on their budgets (or should I say, lack of budgets). The unfortunate thing is that a majority of people are freakin' cheapskates. They don't donate, they don't pay, yet they're the first to start yelling when things go wrong.

That's not their problem, it's their reason to exist.
Open source is usually just that: a bunch of people that want to give something away. For free.

I mean, what's worse, on OSS project that doesn't gather much interest and dies in a few months, or Bixby that has probably eaten billions by now and will never have anything to show for it?

 

[trparky]

Open source is usually just that: a bunch of people that want to give something away. For free.

But that's not a viable business plan, that's not going to put food on your table. Gas in your car's tank. A roof over your head. I really could go on and on really. Is it a sad reality? Yes! But that's how the world works and until we change the very basics of how the world works and we embrace something that's similar in nature to what's presented in Star Trek where it's just a happy utopia where you can paint if you want to because you can just get your food from a hole in the wall (I'm referencing the food replicator here), it's just not going to work.

 

[bug]

But that's not a viable business plan, that's not going to put food on your table. Gas in your car's tank. A roof over your head. I really could go on and on really. Is it a sad reality? Yes! But that's how the world works and until we change the very basics of how the world works and we embrace something that's similar in nature to what's presented in Star Trek where it's just a happy utopia, it's just not going to work.

It's a very viable business plan if I can add an open source project that's actually useful to my resume. It will put food on my table.

Open source is first about people. For some reason you keep talking about like a bean counter. Not that it's a bad thing, but it's a really, really narrow understanding of what open source is.

 

[trparky]

For some reason you keep talking about like a bean counter.

No, I think economically because in the end all humans need food. Don't get me wrong, open source is a laudable goal but until we, as a species, achieve a non-scarcity based economic system because literally everything is free because you can just walk up to your food replicator and ask it for a steak dinner and have it appear out of nowhere, I just don't see how it'll work.

 

[bug]

No, I think economically because in the end all humans need food. Don't get me wrong, open source is a laudable goal but until we, as a species, achieve a non-scarcity based economic system because literally everything is free because you can just walk up to your food replicator and ask it for a steak dinner and have it appear out of nowhere, I just don't see how it'll work.

Well, if you don't see how it will work, you've got a problem. Because it works already.

 

[trparky]

Well, if you don't see how it will work, you've got a problem. Because it works already.

The way I see it is the typical starving artist. Sure, your painting is nice but if no one buys it and thus giving you money, you're going not going to be able to eat let alone make another painting. Do you see where I'm coming from?

Because it works already.

Tell that to the graveyard that is GitHub. I've explored GitHub, thousands of projects that never got off the ground. The code is there but often it's so buggy or undocumented that I'd have better luck picking it apart for the scraps and building my own solution. I've done it, I've built my own programs from scraps that I found on GitHub only to have to fix it so much that I just ended up rewriting the whole damn thing.

 

[bug]

The way I see it is the typical starving artist. Sure, your painting is nice but if no one buys it and thus giving you money, you're going not going to be able to eat let alone make another painting. Do you see where I'm coming from?

Yes, you don't know what you're talking about, you think open source is an all or nothing approach.

It's not. It's something people are doing in their spare time (you're interrupting me from my Android project right now), it's something that is both written and studied in universities, it's something you at your job if you're paid to. It can even be something you do in your spare time because it helps you at your job.

And if you want to make a living off open source, you do that by charging for support. Or by extending your open source project with non-open functionality.

The way I see it is the typical starving artist. Sure, your painting is nice but if no one buys it and thus giving you money, you're going not going to be able to eat let alone make another painting. Do you see where I'm coming from?

Tell that to the graveyard that is GitHub. I've explored GitHub, thousands of projects that never got off the ground. The code is there but often it's so buggy or undocumented that I'd have better luck picking it apart for the scraps and building my own solution. I've done it, I've built my own programs from scraps that I found on GitHub only to have to fix it so much that I just ended up rewriting the whole damn thing.

Please, not that idiocy again. I've already told you in this industry 80% of the project fail anyway.

 

[trparky]

Or by extending your open source project with non-open functionality.

If we go by the GPL, you can't do that; any and all changes you make must be submitted back to the community from which it came from. There's a reason why there's the BSD license, it doesn't have that licensing restriction. Is it any wonder why Apple chose OpenBSD to build MacOSX from? Yeah...

 

[bug]

If we go by the GPL, you can't do that; any and all changes you make must be submitted back to the community from which it came from. There's a reason why there's the BSD license, it doesn't have that licensing restriction. Is it any wonder why Apple chose OpenBSD to build MacOSX from? Yeah...

Red herrings... You're starting to see you were wrong, right?

 

[trparky]

Are you referring to the idea that GPL ≠ Open Source and Open Source ≠ GPL?

 

[bug]

Are you referring to the idea that GPL ≠ Open Source and Open Source ≠ GPL?

No, I mean I didn't say you can extend all open source code and you went ahead and picked on a particular case anyway. Answering to questions/problems that were never asked, it's a classic means of derailing a discussion

 

[moproblems99]

No, I think economically because in the end all humans need food. Don't get me wrong, open source is a laudable goal but until we, as a species, achieve a non-scarcity based economic system because literally everything is free because you can just walk up to your food replicator and ask it for a steak dinner and have it appear out of nowhere, I just don't see how it'll work.

You're looking at it as if OSS is all someone does. Many open source projects are people's spare time projects for the love of doing it. They usually already have jobs. Or college kids. Or any other reason. They aren't doing it to put food on the table (unless for a resume).

 

[trparky]

You're looking at it as if OSS is all someone does. Many open source projects are people's spare time projects for the love of doing it. They usually already have jobs. Or college kids. Or any other reason. They aren't doing it to put food on the table (unless for a resume).

Perhaps I am. Maybe I'm too caught up on the success of big projects like Mozilla Firefox, Chromium, and of course the Linux kernel itself. They all took off and became hugely successful projects that people the world over uses. They're classified as the quintessential open source success stories that took over the world.

 

[Minus Infinity]

Intel's 7nm may be in trouble but their 16 point font is way denser than competing 8 point fonts and shows they still have technical superiority where it counts.

 

[silkstone]

Perhaps I am. Maybe I'm too caught up on the success of big projects like Mozilla Firefox, Chromium, and of course the Linux kernel itself. They all took off and became hugely successful projects that people the world over uses. They're classified as the quintessential open source success stories that took over the world.

Open-wrt is another hugely successful one, with very little investment, AFAIK. Still some pretty big name brands come with open-wrt as an option.

 

[trparky]

Still some pretty big name brands come with open-wrt as an option.

And I hope that those brands contribute money towards OpenWRT's development. However, I wouldn't bet on it. The cynical bastard in me says otherwise.

 

[bug]

And I hope that those brands contribute money towards OpenWRT's development. However, I wouldn't bet on it. The cynical bastard in me says otherwise.

It's ridiculous how few contributions companies that benefit from open source make, that much is clear. It's also idiotic, throwing a few $$$ towards people that give you goodies for free only ensures you get better goodies in the future. But people are that short-sighted, nothing you can do about it.

 

[trparky]

But people are that short-sighted, nothing you can do about it.

And there's the crux of my issue that I was driving at earlier. Right there, summed up in one phrase.

 

[bug]

And there's the crux of my issue that I was driving at earlier. Right there, summed up in one phrase.

Yes, but that's a problem with people, not with open source. Open source is just one of the many things affected by shortsightedness.

 

[Caring1]

Look, if your boothole is vulnerable, stick a plug in it so no nasties can't get in alright.

 

[lexluthermiester]

Soooo...

Back on topic, I've actually tried this vulnerability(I run several devices that have GRUB2 installed). It's a kick to the jimmies at best to make it work right and there is no way in heaven or hell someone is remoting in to do it, at least based on the scenario's described by the data sheet and what I tried. Granted, I'm not the most freaky-neeky crackster in the world, but it's just not feasible to take advantage of the "hole-in-the-boot" unless the system in question is an extremely high value target and there are no easier avenues of exploit(which is unlikely).