[coreboot] barbarians at the gates

[Brendan Trotter]

Hi,

On Fri, Sep 9, 2011 at 10:52 PM, Peter Schmidt <ps947 at yahoo.de> wrote:
> seems like more and more dongle-functionality is going into UEFI:
>
> http://www.h-online.com/security/news/item/Windows-8-to-include-secure-boot-using-UEFI-2-3-1-1335246.html
> http://vr-zone.com/articles/the-upgrade-path-to-ivy-bridge-might-be-blocked-by-changes-to-uefi/13513.html
>
> Since their "Next-Gen" "Trusted Computing" "Deep Shit" was an utter failure, one could expect, that sooner or later they would be at the gates again with this, "functionality".
>
>
> Besides spreading the word around, that there IS an alternative to UEFI, what else can I as a customer do, to ensure there will always be at least a few mainboards which run fully stable (and maybe even out-of-the-box) with coreboot (+SeaBIOS/GRUB) ?

>From a consumer's perspective, "fully stable" is expected; and using
"fully stable" as a marketing strategy isn't likely to get more than a
groan. The main things actual consumers care about are things like
faster boot times, maintenance and setup hassle, compatibility with
industry standards (BIOS, EFI, ACPI, SMBIOS, PXE, etc) and security.

If you take a look at these areas; for boot times coreboot does have
an advantage. For maintenance and setup hassle it's a nightmare
(unless you can find motherboards/computers that have coreboot
pre-installed). For compatibility with industry standards it's "hit or
miss" (it's hard to be more "EFI compatible" than EFI, for example).
For security coreboot mostly fails (there's a tendency for coreboot
developers to whine about things like the "bad" uses of TPM rather
than recognizing the demand from improved security and then taking
steps to match or exceed the capabilities of alternatives).

I can almost guarantee that someone will say "open source", and they
will be right - open source is an important advantage for people that
are prepared to read/understand the source code.

Unfortunately most actual consumers can't read or understand the
source code (and most of those that can have better things to do), so
actual consumers don't care. The (mostly theoretical) "many eyes"
benefit of open source is not superior to the (very real) "sue your
asses if you screw it up" benefit of dealing with "for profit"
companies. These are *not* mutually exclusive. For example, it would
increase consumer confidence a lot if people could choose to pay for
some sort of "fitness for a particular purpose" guarantee. Even
something simple like "If you want to, you can send us $5 and if
coreboot doesn't work as advertised we'll give you $50" would send a
clear message to consumers that you believe in the reliability of
coreboot enough to try to make profit from that reliability; even if
no consumer ever takes up the challenge and pays that $5. The reverse
is also true - if you don't try to make profit from coreboot in some
way, then some consumers (fortunately not all - things are getting
better) may assume you're unwilling to accept any risk because you
don't have any faith in coreboot yourselves.

Of course a lot of people won't like parts of what I've said. I can't
blame them - I don't like parts of what I've said either. The fact is
that the world is sad and broken, regardless of whether any of us like
it or not.


> **But** how do I make it crystal clear to the seller/manufacturer that the coreboot-support is the reason that make me buy this particular product and not all the marketing bla bla?
>
> Any ideas?
>
> I do not want to write some lame e-mail claiming or demanding something. The moment I give him my money in exchange for the product, I really would like him to understand, that is is the coreboot support I am after. All mainboards have PCIe and DRAM banks, but the one I am buying, has coreboot support.

A much better idea would be telling the retailer "Screw you, I'm
buying a motherboard with coreboot pre-installed directly from
coreboot.org because none of the products you sell mention coreboot
compatibility and I don't want to end up with something that doesn't
work". Retailers don't care why they made a sale as long as they make
a sale, but they do care about lost sales.


Cheers,

Brendan