Conversation

Notices

1. Embed this notice
   Simon Josefsson (jas@fosstodon.org)'s status on Monday, 19-Jan-2026 04:35:05 JST Simon Josefsson

   TIL that the LinuxFoundation "Open source audio DSP firmware and development tools" project assumes signed proprietary firmware verified by Intel ME in your CPU. So much for "Open Source". https://thesofproject.github.io/latest/getting_started/intel_debug/introduction.html#base-firmware

   • Embed this notice
     Alexandre Oliva (lxo@snac.lx.oliva.nom.br)'s status on Monday, 19-Jan-2026 04:35:04 JST Alexandre Oliva

     in reply to
     yeah 😞
     
     I once asked the OSI board whether free software that underwent Tivoization remained Open Source, and they found no reason to say it didn't.
     
     no surprise. Open Source is not about users having control of their computing, it never was.
     
   • Embed this notice
     Alexandre Oliva (lxo@snac.lx.oliva.nom.br)'s status on Tuesday, 20-Jan-2026 00:47:14 JST Alexandre Oliva

     in reply to

     • 翠星石
     Tivoization isn't a problem with the free software
     I guess that's the point that's debatable, and we may differ on that.
     
     free software is software that respects the users' essential freedoms for users to have control over the software. if the software contains a signature meant to prevent users from enjoying those freedoms and that control, in the intended (possibly single) use scenario, would it be reasonable to say that the software is free? I don't think so.
     
     now, it's true that, in order for that freedom-deprivation scheme to work, other nonfree components need to be present in the system. but the problem is not so much that the nonfree components cease to operate (that would indeed be an injustice related with the nonfree components), it's that they prevent modified versions of the previously-free software from operating (which compounds the injustice of the nonfree components with an injustice over software that was supposed to be free)
     
     I don't think the case of SOF is one of digital handcuffs. the SOF programs are not preventing users from doing anything. they would be free software if it weren't for the Tivoizing signatures. and if they implemented digital handcuffs, inasmuchas they're free software, one could escape by modifying the programs. of course, once they're Tivoized, escape is no longer an option in the intended use scenario, but the handcuffs are not in the SOF programs themselves, but in the nonfree components of SOF-targeted devices.
     
     CC: @jas@fosstodon.org
     
   • Embed this notice
     翠星石 (suiseiseki@freesoftwareextremist.com)'s status on Tuesday, 20-Jan-2026 00:47:15 JST 翠星石

     in reply to

     • Alexandre Oliva
     @lxo @jas Tivoization isn't a problem with the free software - it's a problem related to the proprietary software ceasing to operate and therefore making it unreasonable or impossible to develop a free replacement.
     
     Digital handcuffs on what should be free software is something different to Tivoization.
   • Embed this notice
     Alexandre Oliva (lxo@snac.lx.oliva.nom.br)'s status on Wednesday, 21-Jan-2026 00:05:47 JST Alexandre Oliva

     in reply to

     • 翠星石
     I'm not seeing the difference you're claiming. the SOF binaries and the signature (by an Intel-controlled secret key) on them work exactly like Tivo-supplied binaries and signatures (by a Tivo-controlled secret key): there's a component on the sound cards that checks for the signatures, just like on Tivo systems, and that prevents the binaries from running if the signature doesn't match.
     
     now, you make it sound like the unsigned binary would still run, it's just other parts of the system that would cease to function. that doesn't match whatever little I have found, but... where can I find more information to understand how that (other?) problem affects us?
     
     CC: @jas@fosstodon.org
     
   • Embed this notice
     翠星石 (suiseiseki@freesoftwareextremist.com)'s status on Wednesday, 21-Jan-2026 00:05:49 JST 翠星石

     in reply to

     • Alexandre Oliva
     @lxo @jas >if the software contains a signature meant to prevent users from enjoying those freedoms and that control, in the intended (possibly single) use scenario, would it be reasonable to say that the software is free?
     The software is rendered proprietary by digital handcuffs in that case, which is something else to Tivotization.
     
     What Tivo originally did was to provide the source code and installation information for all the free software - but make all the proprietary software stop running (you would have a DVR that could run VLC, but you couldn't run any of Tivo's proprietary software for the purposes of inspecting it/the RAM contents to see what spying it did and for its replacement) - which the GPLv2 does nothing about, as the GPLv2 doesn't contain any requirement to agree to not sabotage the execution of the system's aggregated software; https://sfconservancy.org/blog/2021/jul/23/tivoization-and-the-gpl-right-to-install/
     
     Tivo later decided to intentionally infringe copyright by infringing the GPLv2 with future Tivo models, by refusing to provide the complete corresponding source code and installation information (the software was handcuffed - you needed a signing key for it to execute) and as a result, Tivotization is commonly confused with Tivo's GPLv2 infringement.
     
     >I don't think the case of SOF is one of digital handcuffs.
     It is a case of digital handcuffs - there is source code that is claimed to correspond to the binaries and it can be compiled into a binary - but you can't run it on most of the relevant sound cards, as you need a private key that Intel refuses to provide (the binary can be made to execute on some SBC's and certain chromebooks, as Intel has provided the private key, but of course other parts of those are handcuffed).
     
     It isn't a case of Tivotization, as with the necessary private key, the user could install a free DSP program and all the software on the computer would continue to execute without any of the proprietary software ceasing to function.
   • Embed this notice
     Simon Josefsson (jas@fosstodon.org)'s status on Wednesday, 21-Jan-2026 01:29:11 JST Simon Josefsson

     in reply to

     • Alexandre Oliva

     @lxo @Suiseiseki@freesoftwareextremist.com I’m no expert on SOF but I’m not sure this is a pure tivoization example? The SOF project contains a lot of FOSS code. But according to that documentation, it all requires a non-free signed firmware to be loaded. I’m not sure the source code for that firmware is public at all? But it doesn’t seem unlikely that (at least some parts of) SOF is still useful even if you don’t load that firmware.

   • Embed this notice
     Alexandre Oliva (lxo@snac.lx.oliva.nom.br)'s status on Wednesday, 21-Jan-2026 01:29:11 JST Alexandre Oliva

     in reply to
     from what I gathered when I looked into it, the firmware developed and distributed by the SOF project is all free software, and it's designed to always be signed in order for it to be loaded. the twist is that they've made a public signing key, that works on some devices, and a private signing key, that Intel keeps to itself, that works on most/all devices. they distribute binaries signed with both of them, but only Intel can make the latter signatures, so, on devices that demand Intel's signature, that scheme renders the binaries nonfree, because users can't install or run modified versions. that much is Tivoization to the letter.
     
     now, there might be more to it, and if there is, I'd love to learn about it.
     
   • Embed this notice
     Alexandre Oliva (lxo@snac.lx.oliva.nom.br)'s status on Wednesday, 21-Jan-2026 01:51:57 JST Alexandre Oliva

     in reply to
     if that text file were the preferred form to make modifications to it (AKA source code), then I guess it wouldn't deserve the "proprietary" qualifier any longer. but we have neither sources nor a suitable freedom-respecting license, and either one would be enough to make it proprietary.
     
     but the SOF situation is entirely different from that. there is source code for the programs (though I admit to not having searched for blobs in them), and there is a free license that (purports to?) apply to them. AFAICT the only problem with SOF is the Tivoization that affects the binaries signed with the Intel-private signing key.
     
   • Embed this notice
     Simon Josefsson (jas@fosstodon.org)'s status on Wednesday, 21-Jan-2026 01:51:58 JST Simon Josefsson

     in reply to

     • Alexandre Oliva

     @lxo I assumed SOF contained more than just the source-code for the firmware here, but that may be incorrect. What you write seems consistent with the documentation I'm reading. The "source code" for the ALSA topology is also interesting, as it is compiled into a binary /lib/firmware/ blob. There is source code for it, but it is so hardware-specific and magical that I wonder if it would qualify as the preferred form of making modifications to. https://github.com/alsa-project/alsa-topology-conf/blob/master/topology/hda-dsp/skl_hda_dsp_generic-tplg.conf

   • Embed this notice
     Simon Josefsson (jas@fosstodon.org)'s status on Wednesday, 21-Jan-2026 01:51:58 JST Simon Josefsson

     in reply to

     • Alexandre Oliva

     @lxo Would "compiling", for example, the binary proprietary Intel WiFi firmware blobs from a text-file into a binary magically make things acceptable if the license on the text file is BSD-3-Clause?

   • Embed this notice
     Alexandre Oliva (lxo@snac.lx.oliva.nom.br)'s status on Wednesday, 21-Jan-2026 01:52:11 JST Alexandre Oliva

     in reply to

     • Alexandre Oliva
     the reason I mention this "preferred form to make modifications" is that we have had programs made available under free licenses, but without source code, that have been decompiled into usable source code, and that source code was then used to maintain and develop the program further. although the original program wasn't free software due to the lack of source code, the programs built out of these decompiled and modified sources is free software. that's how we got a freedom-respecting program to fill in income tax returns in Brazil. it turns 19 this year.
     
     CC: @jas@fosstodon.org
     
   • Embed this notice
     Alexandre Oliva (lxo@snac.lx.oliva.nom.br)'s status on Thursday, 22-Jan-2026 00:25:48 JST Alexandre Oliva

     in reply to

     • 翠星石
     interesting. this suggests that naming the practice of blocking the execution of modified or recompiled versions of programs as Tivoization may have been a misnomer. from what you say, it seems that Tivo did not do that. but that didn't stop others from doing just that. for lack of a better term to describe that practice, I keep on calling it Tivoization.
     
     I don't think this case is one of digital handcuffs, at least not in the program itself. it's other components of the device reacting to the modification. you could say it's digital handcuffs in the other components. but it's not the program itself stopping you from doing things.
     
     I guess what feeds the confusion is that GPLv3 addressed both issues. but the definition of Tivoization, e.g. on Wikipedia, is pretty clear and well-referenced: it's about blocking the execution of modified versions, without any mention to other programs' refusing to function along with the modification.
     
     CC: @jas@fosstodon.org @Suiseiseki@freesoftwareextremist.com
     
   • Embed this notice
     翠星石 (suiseiseki@freesoftwareextremist.com)'s status on Thursday, 22-Jan-2026 00:25:50 JST 翠星石

     in reply to

     • 翠星石
     • Alexandre Oliva
     @lxo @jas *for a specific Tivo model?
     
     The link I posted above describes the only case where detailed information is provided I've found and the scheme described was where Tivo would give you the source code and installation information for the mostly free software OS, but on compiling and installing such OS, with or without changes, the proprietary software programs would stop executing.
   • Embed this notice
     翠星石 (suiseiseki@freesoftwareextremist.com)'s status on Thursday, 22-Jan-2026 00:25:51 JST 翠星石

     in reply to

     • Alexandre Oliva
     @lxo @jas >on them work exactly like Tivo-supplied binaries and signatures (by a Tivo-controlled secret key):
     I don't know if confident if Tivo ever setup such a scheme - do you have a link to exactly what Tivo did for a specific Tive model?
     
     It's not Tivotization, as if it was tivotized, the unsigned binary would still run, but other parts of the system would cease to function.
     
     It's a case of digital handcuffs - the software won't run without a signature and you don't have the key and how the source code that probably mostly, but not completely corresponds, happens to be free software doesn't change anything - as the software is only practically useful to run on certain model DSPs.
   • Embed this notice
     Alexandre Oliva (lxo@snac.lx.oliva.nom.br)'s status on Saturday, 24-Jan-2026 03:49:38 JST Alexandre Oliva

     in reply to

     • 翠星石
     the article is not wrong. that's how Tivoization was coined and explained during the GPLv3 drafting. I know as much. I was there, and I took part in learning and spreading that misnomer. I don't have the GPLv3 drafting documents handy, but I have plenty of drafts and published articles of my own that go along with how the terms were defined then, and they agree with what Wikipedia says.
     
     I don't like the notion of fixing that error by stretching yet another term that already has a different meaning instead. that would add to the confusion instead of bringing clarity IMHO.
     
     CC: @jas@fosstodon.org
     
   • Embed this notice
     翠星石 (suiseiseki@freesoftwareextremist.com)'s status on Saturday, 24-Jan-2026 03:49:39 JST 翠星石

     in reply to

     • Alexandre Oliva
     @lxo @jas >for lack of a better term to describe that practice, I keep on calling it Tivoization.
     Digitally handcuffed hardware that is designed to make it cryptographically impossible for the user to control the software, or something similar, is the only way to accurately describe it without causing confusion.
     
     Describing something that Tivo didn't do, as "Tivoization" is clearly confusion.
     
     Handcuff-ization or similar seems much clearer.
     
     >you could say it's digital handcuffs in the other components. but it's not the program itself stopping you from doing things.
     Yes, the program is digitally handcuffed, rather than the program having digital handcuffs.
     
     >e.g. on Wikipedia, is pretty clear and well-referenced: it's about blocking the execution of modified versions, without any mention to other programs' refusing to function along with the modification.
     I actually checked the references on realizing that the article was wrong - most of the references are either unrelated, or contain the complete opposite of what the article claims.