Purism suffered a distributed-denial-of-service (DDoS) attack on July 29, 2023, which took down their site, as they explained on their Matrix channel and forum (when the site came back online). See: https://forums.puri.sm/t/sites-down-no-comms/21000/3
It is likely that someone who owns a botnet saw Rossmann's criticism of Purism and decided to that the company deserved to be attacked, which is a really rotten thing to do, because then people assume that Purism is hiding something.
I agree that Purism should have refunded the cancelled orders, but calling the company a "scam" is way over the top, considering the huge amount of dev work that Purism has done on mobile Linux and the Phosh interface. I own both the Librem 5 and Librem 5 USA and the company is definitely not a "scam".
@anw, According to the Purism forum, the shipping queue for the Librem 5 has reached people who pre-ordered on October 20-25, 2017, so you should have gotten your phone by now. You should contact Purism support to ask about your order. See: https://forums.puri.sm/t/estimate-your-librem-5-shipping/112...
It depends on your goals. If you donate to the GNOME Foundation, your donation won't help develop Phosh (which is the leading mobile Linux interface according to 3 different PinePhone user surveys) and it probably won't be used to make GTK/GNOME ecosystem become adaptive and mobile-friendly. If your goal is to advance mobile Linux on the GTK/GNOME/Phosh platform, then ordering the Librem 5 is the best way to get funds to the 10 software devs working on it at Purism. See: https://source.puri.sm/Librem5/community-wiki/-/wikis/Freque...
I own both the PinePhone and Librem 5 USA, and I'm seriously impressed by the amount of work the Purism devs do for PinePhone users (who are the majority of the Phosh users).
As for Xiaomi being comically large, I found the mid-range Samsung and Motorola models to have larger bezels and to generally be larger for similar specs when I bought my Xiaomi Redmi Note 7 a couple years ago. The reality is that the majority of phones from Motorola, Xiaomi, LG and Nokia are designed and manufactured by 3 Chinese ODMs (Wingtech, Huaquin and Longcheer), and even 20% of Samsung's phones come from these 3 ODMs. See: https://amosbbatto.wordpress.com/2021/12/10/comparing-l5-and...
> Looking up the Librem 5 devicetree in the upstream kernel, it seems it was submitted on Aug 21 2020. Aspen shipped in September 2019, so it took them about a year from shipping to upstreaming bring-up, and that's not considering internal prototypes and that the SoC was announced in mid 2018, so they had plenty of time to work on things internally. I submitted upstream bring-up for the M1 Mac Mini with the device tree on Feb 4 2021, just 4 months after it was announced in Nov 2020.
Before anything else, let me say thank you for your work on the M1, because it is essential that we have Linux support for processors even when the device maker is opposed. Considering how many millions of people have bought Apple's M1 devices, Asahi's work is critical because it provides a path for people to discover a freer system when they get disgusted with Apple's bad practices and the restrictions of its "walled garden."
You are comparing the work of a company with two kernel developers (Angus Ainslie and Martin Kepplinger) to an entire community working on Linux support for the M1. Purism has only shipped 2600 Librem 5's so far, whereas Apple is shipping roughly 7 million M1 Mac PCs and 15 million M1 iPads every quarter. If you are going to brag about getting M1 support into mainline Linux within 4 months of the release of the M1, consider the fact that the first commits to mainline Linux for the i.MX 8M processors were submitted just 8 days after NXP announced that it had started volume shipping of the processors (https://www.pengutronix.de/en/blog/2018-01-17-first-mx8m-mai...). This was possible because NXP shipped early versions of the processor to many companies and has released 7000 pages of documentation on the processor, plus NXP pays several of its own employees to work on getting the i.MX 8M supported in mainline Linux. It does make a huge difference whether a company decides to collaborate with the Linux community or not.
You also have to keep in mind that Apple has shipped 2 billion devices with A-series processors that never got mainline Linux support, so we got really lucky that 1) Corellium managed to figure out how to run Linux on the M1 and 2) Apple decided to not block the use of custom kernels with the M1. Corellium (which currently has 20 employees) has been working on figuring out how Apple processors work since 2017 (https://craft.co/corellium) and company's blog makes clear that it was its previous work on the A-series (boot sequence, PCIe and USB controller) which helped it get Linux support working so fast on the M1 (https://www.corellium.com/blog/linux-m1), so Corellium wasn't starting from scratch in figuring out how the M.1 works.
By the way, it's worth pointing out that most of Purism's dev work hasn't focused on the kernel, but has instead focused on creating the Phosh mobile environment on top of GTK/GNOME, and Purism has created about a quarter million lines of new code so far (https://amosbbatto.wordpress.com/2021/12/15/amount-code-libr...), and 169.4k of that code (libhandy, libadwaita, Chats and Calls) has been incorporated as official GNOME projects. Purism purposely designed the L5's software to work as a thin overlay on top of an existing desktop Linux stack, so PureOS/Phosh has done a better job than Meego, Sailfish OS, Firefox OS, Ubuntu Touch and WebOS at making a version of mobile Linux which is compatible with the larger Linux ecosystem. Purism commits upstream as much as possible to projects like Linux, wlroots, ModemManager, Geoclue, GTK, GNOME and about 20 different GTK/GNOME apps (Nautilus, gEdit, GNOME Calendar, CNOME Contacts, GNOME Clock, etc.) so that the L5 will be easier to maintain and be able to run on other Linux distros (postmarketOS, Mobian, Ubuntu Touch, etc.).
> To my knowledge, the L5 does not support any kind of secure boot (at least it is not implemented yet; the SoC itself might)
The i.MX 8M does have a secure boot option, but Purism isn't going to use it because it isn't controllable by the user. Purism's Kyle Rankin commented that they are discussing how to implement a user-verifiable boot procedure, like they have with PureBoot + Librem Key on their laptops, but Purism has a lot of other stuff on its plate (like suspend to RAM, camera auto-focus, encryption with keys from the OpenPGP card, etc.) which is higher priority, so I doubt that it will be implemented soon. The Ubuntu Touch port should have secure boot, but UBports has put their porting of the L5 on hold to focus on the PinePhone and PineTab, so I assume that will also take a while.
The RYF certification program is based on Richard Stallman's outdated idea that hardware shouldn't be changed and software is anything that can be changed or updated after the device is produced. Anyone who looks at how x86 processors use microcode updates and the security threats with Meltdown and Spectre knows that a modern x86 PC needs to get microcode updates. Even worse is the fact that building a device to comply with RYF actually makes it more difficult to work on freeing the blobs. In the case of the Librem 5, you have to write to the SPI NOR Flash chip to replace the 4 blob files, rather than simply changing the files stored on in the /lib/firmware directory.
However, there are people in the FSF who recognize this. See the comments of Leah Rowe (the Libreboot maintainer) about the problems with the RYF criteria:
https://lists.gnu.org/archive/html/libreplanet-discuss/2022-...
(read her comments in the libreboot policy she linked to)
> That's why we need to educate users about the realities of the devices they choose to purchase, instead of slapping meaningless "RYF" labels on them and discouraging nuanced discussion.
I largely agree that RYF has problems, but it isn't useless, since it does tell people that they can install a new OS or upgrade it without having to deal with proprietary blobs. However, if people want to upgrade the firmware, a RYF device makes that very inconvenient, because you can't just stick the new firmware in the /lib/firmware directory, but have to follow an awkward procedure to upgrade each component's proprietary firmware, and the RYF rules are unclear about whether those upgrades are even allowed. I have written repeatedly to the FSF asking for clarification on whether proprietary firmware can be upgraded under the RYF rules, and I have never received an answer. See: https://forums.puri.sm/t/does-respects-your-freedom-certific...
However, I would agree that the RYF certification isn't useful for distinguishing whether the PinePhone's firmware is more free than the Librem 5's firmware. In fact, it can be argued that the PinePhone has inspired a lot of community work to replace parts of the EG25-G modem's proprietary firmware, so the PinePhone will potentially have a freer modem than the Librem 5.
RYF also has nothing to say about the freeness of your hardware. For example, the MNT Reform provides all its sources for the design of the hardware, so anyone can legally make it, whereas Purism has released the PDF files for the L5's schematics, and the STL files for its case, but won't release the original design files for the boards and case until it recovers its development costs. PINE64 releases the board schematics as PDF files, but they have a normal copyright, so no one can legally reuse or modify them. If you want to do board repair, however, you need to know the placement of each component on the board, and neither Purism nor PINE64 have released board views, whereas board views are leaked for most Apple devices.
> the RYF workaround development was completely unnecessary and just serves to legitimize the FSF, which, indeed, is the root of the problem.
It seems that you want to throw the baby out with the bath water. In my opinion, the basic goals of the FSF need to be supported. The problem is the strategy that the FSF uses to reach those goals and its specific policies. I want to see a world where ordinary people can control the technology that they rely on, rather than technology being used as a means to control people.
As I see it, we got lucky with the x86 architecture, because Intel and AMD used a standard booting procedure which wasn't locked, so it was possible to install our own OS on almost any PC in the past, but as PCs move to ARM, I fear that every company is going to copy Apple in designing their own ARM processors for PCs, which have custom booting procedures. Maybe Qualcomm, Samsung, MediaTek, UNISOC and all the rest who are reportedly designing custom ARM processors (Google, Xiaomi and Oppo) will release their files or share info, but I suspect that many PCs in the future will be like the Apple A-series processors where we can't install Linux.
In my opinion, the best strategy to avoid this dark future is to support the device makers and component makers who support free/open source software, rather than continuing to buy products from companies that don't share our goals. Apple sued Corellium (and thankfully lost in court), which is a good indication of Apple's attitude toward its users. When we buy Apple products, we give more resources to a company that is openly hostile to users being able to control their own hardware.
While I have specific criticisms of the RYF, I want the RYF certification program to be reformed so it is useful in the real world, because I do think that people who care about FOSS should be giving their money to companies that support their goals, because that is the best way to create a sustainable industry in the long term that respects user rights and are willing to work with the community. Giving our money to companies like PINE64, Purism, Lulzbot, OLIMEX, Raptor Systems, Arduino, MNT, etc. helps build up our leverage, because these companies will have more power to make demands of component suppliers.
NXP has positioned itself as the best ARM manufacturer for the Linux community (ahead of Rockchip), whereas I rank Apple as the second worst (although today I would now place it as the third worst ahead of UNISOC and HiSilicon). See: https://forums.puri.sm/t/concerns-about-the-security-risk-of...
I know that the Librem 5 doesn't have great performance compared to a phone based on an A13 or Snapdragon 888 (see my benchmarks: https://amosbbatto.wordpress.com/2021/12/10/comparing-l5-and...), but I bought the phone anyway, because I know that Purism went out of its way to select component manufacturers who support FOSS. NXP makes commits to mainline Linux to support its i.MX processors, and releases documentation to the community without NDA's. Silicon Labs (formerly Redpine Signals) releases the drivers for its WiFi/Bluetooth chips under the GPL 2 and altered its firmware at the request of Purism so it didn't have to load the firmware from the main Linux file system. By giving money to Purism, NXP and Silicon Labs, I'm helping to build up a better supply chain, so there is more hope of getting hardware in the future that respects our digital rights.
Hi, I'm the "random community member" who wrote that FAQ answer. Thanks for investigating how this works. Where is the file cpu_rec.py located? I can't find it.
I will edit the FAQ answer to clarify that the DDR training blobs are being executed on an ARC core in the DDR controller, and not on the M4 core. I was going off what Angus Ainslie wrote (https://puri.sm/posts/librem5-solving-the-first-fsf-ryf-hurd...) that 'the M4 is the “secondary processor” that handles the blobs', and I conflated "handles" with "executes".
However, you seem to be unfairly criticizing Purism for obfuscation and legalisms, when it seems to me that Purism is just trying to comply with the FSF's rather arbitrary RYF rules, and Ainslie's article on the Purism web site and Nicole Faerber's talk (https://media.ccc.de/v/Camp2019-10238-a_mobile_phone_that_re...) both explained how Purism is using the secondary processor exception in the RYF rules.
It is not like Purism had any better options in terms of SoC's that it could have chosen for the Librem 5. Raptor Computing is now facing the exact same problem with the proprietary Synopsys DDR4 timing blobs in the POWER 10 processor, so this is actually a common problem with most modern processors. It seems to me that Purism did the best that it could with an impossible situation, and if anybody should be criticized it is the FSF for not acknowledging how modern hardware actually works.
Another thing that I find problematic is your argument that 58 KB of DDR4 timer training blobs represent a security threat in the real world and make the Librem 5 no different than an Apple device with an M1 processor, which is literally a black box. Forget the fact that the L5 is the first phone to have free/open source schematics since the GTA04 in 2012 and we know the 1267 components on its PCBs, plus we have 7000 pages of documentation for the i.MX 8M Quad processor, and everything is running free/open source drivers.
There is only so much code that you can hide inside 58 KB of blobs and that early in the boot sequence, you can't rely on anything else being operational in the device, so you would need to have all the code to initialize and control components on the phone. Think about how much code would be needed to initialize the cellular modem or WiFI and then run a TCP/IP stack to communicate with the outside world. It isn't hard to verify that the blobs that are stored inside the L5's SPI NOR Flash chip are the same ones being distributed by NXP, so then you are left with the theory that NXP or Synopsys are distributing blobs that do something malicious, which would be suicidal for either of those companies if anyone ever discovered it. Supermicro's stock lost 40% of its value after Bloomberg published one story about the Chinese government inserting spy chips in Supermicro motherboards, and nothing in Bloomberg's article was verifiable. Companies like NXP and Synopsys are very unlikely to risk their businesses, even if the NSA asks them, so I find the whole scenario far-fetched.
Yes, the CPU is weak, suspend-to-RAM hasn't yet been added to the mainline Linux driver for the i.MX 8M, camera auto-focus doesn't yet work, and lot of work is needed for full functionality of the Megapixels camera app and use of an OpenPGP smartcard, but you are ignoring all the progress that has been made. Purism started with a new chip that didn't yet have good mainline Linux support and had to make several hundred commits to mainline Linux to support half a dozen new chips. Purism created a new mobile environment for Linux, which 65% of PinePhone users say in a poll is their favorite interface. Purism created the first free/open hardware phone since the Golden Delicious GTA04 in 2014 and manufactured the first phone in the US since the Motorola Moto X in 2013. The Librem 5 contains 6 innovations in the mobile phone industry, which is more innovations than any phone since the Samsung Galaxy S5 released in 2014. This is the first phone ever produced where the manufacturer promises lifetime software updates and the processor will be produced by the manufacturer (NXP) until at least Jan. 2033.
The NXP i.MX 8M Quad processor in the Librem 5 has "Made in Korea" stamped on them and there have been news articles published about how NXP was switching its foundry work from TSMC to Samsung. By the way, the i.MX 8M is designed in Austin, Texas (by the old Motorola division, which turned into Freescale and then was bought by NXP).
Purism has said that it will be providing proprietary firmware updates, and it already has instructions how to update the firmware for the RS9116 WiFi/BT on its web site.
Because Purism selected components for the Librem 5 that will be manufactured for many years, it is more likely to get firmware updates than most smartphones. Because the drivers are all FOSS, they can be updated by the community, and some cases the manufacturer helps maintain the mainline Linux drivers, so timely updates are very likely. For example, NXP promises to sell its i.MX 8M Quad processor until at least Jan. 2028 and it helps maintain the mainline Linux driver. Likewise, Redpine Signals helps maintain the mainline driver for the RS9116 WiFi/BT and likely to keep manufacturing the chip for at least the next 5 years.
In contrast, the SoC used in a typical smartphone is only manufactured for 1-2 years and it typically only gets 2-3 years of support from the manufacturer, so the Librem 5 is more likely proprietary firmware updates than most smartphones.
As for the question of whether it is better to store the proprietary firmware in the /lib/firmware directory or in the component or in Flash chips on the motherboard, there are advantages and disadvantages, so you have to weight what is important. When firmware is stored and loaded from the /lib/firmware directory, it is easier to update and the user will automatically get the latest firmware when upgrading the software on the device. In contrast, the user has do a separate procedure to upgrade the firmware and many users are unlikely to do it, so any potential security holes in the firmware are less likely to be closed with updates. However, a lot of this depends on what Purism does in the future to push firmware updates, so we shouldn't automatically assume that the Librem 5 will be insecure. The benefit of not storing the firmware in /lib/firmware is because it makes the user more conscious of the proprietary blobs on the device, and the user can make a deliberate choice whether to install firmware updates or not, after reading the description of each update. Also, it is harder for the firmware to be hacked by a bad actor when it is stored in the component or a separate Flash chip, because it requires a separate procedure to flash the firmware, so it can be argued that it is more secure. Another benefit is that system updates can be offered without including any proprietary files, so there are no restrictions on how they are distributed and installed.
In terms of promoting software freedom, I don't know of any cellular modems or any GNSS with FOSS firmware. There were only two WiFi/BT model series whose firmware was reverse engineered by the community but they never got past the experimental state and are now hopelessly outdated since they were 802.11b/g devices. There are some ath9k 802.11n models that required no firmware, but they have poor range and are energy inefficient and require proprietary firmware for the Bluetooth.
In other words, there is no realistic way to make a modern computing device without proprietary firmware, and the only hope is to pressure the manufacturers to release code or documentation for its firmware, but the modern patent situation with wireless communications makes that extremely unlikely to happen. However, the FSF's insistence on trying to separate the proprietary firmware and not let it be executed on the main CPU cores does draw public attention to the problem and show the component manufacturers that there is public demand for free firmware. When companies like Purism go through extreme steps to avoid executing DDR timing code on the main CPU cores, by adding a separate SPI Flash chip to the board to hold the blob and not using the Cortex-M4 core for any other purpose but to execute that blob, it sends a message to NXP that its customers really hate that proprietary blob and it should be eliminated. In contrast, a company that stick that blob in the main Linux file system tells NXP that its customers don't care about that blob and there is no pressure for NXP to eliminate it in future chips. The value of buying RYF products like the Librem 5, RaptorCS computers and Lulzbot is that it is creating a public statement that consumers care about not having proprietary blobs, and that the hardware industry should cater to that crowd. What Purism is doing value in promoting a public message and it is based on a long-term strategy to pressure the industry to free its firmware, whereas the people who criticize it have no strategy for ever achieving change. If they have an alternative strategy for how to free the firmware, I would love to hear it.
The more important point is that Purism selected components from hardware companies that are more willing to collaborate with the community and listen to Purism's requests, so there is more possibility of driving change up the supply chain. Purism paid Redpine Signals to modify its firmware so it could meet the RYF criteria and NXP engineers work with the community on the mainline Linux driver for the i.MX 8M, so it is possible to influence these component suppliers.
I'm a strong believer in "free software" as RMS defined it, and I give the man a lot of credit for getting the movement started. However, my few interactions with him were not pleasant, although I did have an interesting conversation with him once about promoting the environmental benefits of hardware running free software.
My main problem with the FSF has been more in terms of poor strategy in terms of how it engages with the software and hardware industry, rather than the philosophical vision.
I have no idea whether the internal process at the FSF changed or not, but the rules are the same for the FSF endorsing a distro and giving its Respects Your Freedom certification to a piece of hardware.
However, I raised a question about how to interpret the RYF criteria with regard to proprietary firmware updates, and I'm hoping the FSF will clarify the RFY criteria in a way that allows proprietary firmware updates for components that don't execute on the main CPU cores. See: https://forums.puri.sm/t/does-respects-your-freedom-certific...
The people doing the final assembly of the Librem 5 USA are working in Purism's Fulfillment Center in Carlsbad, California, which is a suburb of San Diego. Housing is very expensive in the San Diego area, so we are talking about wages for assembly workers that are much higher than $13 or $14 per hour. It sounds like the company making the PCB's is also located in the San Diego area (based on what Purism said about its Librem 5 DevKit), which means that Purism is paying a company that likely makes prototype boards, which means that Purism is paying a lot more for its boards than Chinese mass production prices. I doubt that Purism has more than a couple hundred orders for the Librem 5 USA, but it says that it will store the parts for the phone and do the final assembly itself. It also is doing just-in-time manufacturing of the phone in very small quantities. All of this has very high unit costs.
Frankly, ThatGeoGuy's assessment of the Librem 5 USA is ridiculous. First of all, he doesn't evaluate what it costs to set up a facility in a San Diego suburb that stores parts with supply chain security, orders small-scale PCBA production, and does small-scale final assembly. Second, he ignores the fact that the Librem 5 USA is a niche product for corporate and government clients who need supply chain security. It is competing with products like the Silent Circle's Silent Phone, Motorola Solutions' LEX L11 and Bittium's Tough Mobile 2. The only one of those phones which publicly lists its price is the Bittium Tough Mobile 2, which costs €1550 (US$1816), so the Librem 5 USA is in the same price range. Third, he totally ignores the cost of paying roughly a dozen developers to work for 3.3 years to develop a Linux phone. How does a company recover those high development costs that have gone way over budget? One way is to develop a side product with high profit margins that caters to niche customers with specialized needs.
ThatGeoGuy, Since you called me that "crazy uncle at Thankgiving," I feel that the "crazy uncle" should have a chance to respond to the arguments that you made in your review:
https://forums.puri.sm/t/pinephone-vs-librem-5/9092/83
Looking at the pin description on page 24 of the A64 Datasheet, it looks like the 8 data pins (CSI_D0 … CSI_D7) are for a MIPI Camera Parallel Interface (CPI), but Allwinner is calling it "CSI" (MIPI Camera Serial Interface).
This is really confusing, but I am simply repeating what the A64 docs say.
Out of curiosity, what is the highest-resolution still photo anyone has taken so far on the PinePhone? Maybe I should list that in the table.
Is 1080p@15fps the best video anyone has managed so far with the PinePhone?
I see that I was mixing up inputs/outputs and channels. The A64 supports 4 inputs and 4 outputs, but only two channels in the DAC and ADC. I see that the DAC supports 8 - 192 kHz, but the ADC only supports 8 - 48 kHZ. OK, I'll clarify that in the table.
-----
2.8.Audio Subsystem
Audio Codec
•Two audio digital-to-analog(DAC) channels
•Stereo capless headphone drivers:
-100dB SNR@A-weight
-Support DAC Sample Rates from 8KHz to 192KHz
•Support analog/ digital volume control
•Differential earpiece driver
•Analog low-power loop from line-in/microphone to headphone/earpiece outputs
•Support Dynamic Range Controller(DRC) adjusting the DAC playback output
•Accessory button press detection
•Four audio inputs:
-Twodifferential microphone inputs
-One differential Phone input
-Stereo Line-in L/R input
•Four audio outputs:
-Earpiece amplifier differential output
-Phone amplifier differential output
-Headphone amplifier L/R channel output
-Line-out L/R output
•Two audio analog-to-digital(ADC) channels
-96dB SNR@A-weight
-Supports ADC Sample Rates from 8KHz to 48KHz
•Support Automatic Gain Control(AGC) and Dynamic Range Control(DRC) adjusting the ADC recording output
•Two PCM interface connected with BB and BT
•One 128x24-bits FIFO for data transmit, one 64x24-bits FIFO for data receive
A lot depends on what online services you are using. The goal of Purism is to provide a suite of online services at Librem One (https://librem.one/) so you don't have to share your personal data with Google, Facebook, Twitter, etc.
It is likely that someone who owns a botnet saw Rossmann's criticism of Purism and decided to that the company deserved to be attacked, which is a really rotten thing to do, because then people assume that Purism is hiding something.
I agree that Purism should have refunded the cancelled orders, but calling the company a "scam" is way over the top, considering the huge amount of dev work that Purism has done on mobile Linux and the Phosh interface. I own both the Librem 5 and Librem 5 USA and the company is definitely not a "scam".