Open Source Firmware — Why Should We Support It?
Arising Problems

A few problems arise if the market is dominated by only a couple of companies using opaque techniques:

Taken from LinuxBoot Repo

Bloatware

On the Open Source Firmware Conference, 2019 in Silicon Valley Ryan O’Leary and Gan Shun Lim showed that there were able to remove 214 out of 424 DXEs within the boot process. DXEs are drivers which get loaded at boot time within the Driver eXecution Environment(DXE) Phase.

That’s an overall reduction of more than 50%.

Normally Firmware needs to be adjusted to every single board. Due to the fact that companies like to save time (and also money) it is much easier to put everything into the firmware that might be needed. This results in more code and longer boot times.

Transparency

As already stated above, most of the Firmware on modern platforms is closed source, which means that the source code is not made publicly available for everyone. In reality, only a handful of developers actually know or have access to the source code. This also means that is not transparent what actually has been implemented and what code is really running.

We have to recap that Firmware is actually the first code that runs when the platform boots up and is capable of reading and writing everything without any restrictions — even your encryption won't save you here.

Security

There are a few major security concerns in current firmware solutions. The lack of transparency is one of those. In my honest opinion, we can not talk about reliable security, if the implementation of those mechanisms is not available in the public domain. The majority of the cryptography community actually relies on open source. Every known and sane cryptographic algorithm or protocol is publicly documented and available.

Closed Source Firmware is just a blob..

..and that is the problem. We do not know what is happening on the lowest level of the hardware — and especially what goes wrong. Writing bugs and making errors is just natural. Hiding those does not help at all. Security by obscurity is no security at all. Therefore it is no surprise that security researches tend to find new vulnerabilities every now and then in closed source firmware. There is a nice blog about firmware security-related topics which you can find here.
['Christian Walter']
['Embedded Systems', 'Programming', 'Technology', 'Computer Science', 'Open Source']