On CNET: Test your bandwidth
BNET Business Network:
BNET
TechRepublic
ZDNet

By John G. Spooner
Posted on ZDNet News: Apr 5, 2005 11:00:00 AM

As computer makers move to embed security features deep within PCs, a fight is erupting over a rarely noticed but crucial piece of system software.

The construction and installation of the BIOS--the basic input/output system that underlies all other applications--are closely guarded by a small number of PC makers, such as Dell, and specialty BIOS programming companies for hire.

Now, for the first time, some critics want to force the industry to abandon its hallmark secrecy. As the BIOS becomes more powerful, these critics argue, consumers must be allowed to freely develop their own alternatives to ensure that they keep control of their devices--and that means they need unfettered access to information.

News.context

What's new:
Details about the basic software that lets your operating system get started are closely guarded. Critics of BIOS secrecy want to force the door open so consumers take charge of their own computers.

Bottom line:
Makers of BIOS software get proprietary information from chipmakers and others. As critics call for free BIOS software, expect those who hold the secrets to keep a tight grip.

More stories on BIOS

"We need a free BIOS, because if we don't control the BIOS we don't control our computers," said Richard Stallman, president of the Free Software Foundation, a Boston-based organization dedicated to promoting the use, modification and redistribution of computer programs. "It puts me in an ethically compromised position to have a nonfree program in my machine."

The free-BIOS initiative comes at a time when the BIOS is undergoing the first major change in its history--a transition from software based on machine code to a new framework dubbed the Extensible Firmware Interface, or EFI. At the same time, efforts to secure PCs through hardware-based defenses are leading critics like Stallman to warn of a pending loss of consumer control over their devices.

The FSF has spearheaded numerous campaigns lobbying for greater consumer control over software. The group now plans to mount a campaign to open up specifications required to write BIOSes. The change that Stallman advocates would let people install, modify and redistribute BIOS software--although not necessarily free of charge. Significantly, that would allow people to circumvent some pending security enhancements, including digital-rights management features aiming to prevent unauthorized use of confidential corporate documents and other copyrighted materials.

If the operating system is the equivalent of a computer's brain, then the BIOS might be compared to the medula oblongata, the place where the brain meets the spine. The most primitive reflexes are governed here, well below the level of conscious thought. Typically, the BIOS announces its presence on start-up via flashing lights and whirring drives as it prepares a machine to receive higher-level instructions from its operating system.

Given the closely held nature of the BIOS business, Stallman and his foundation are likely to face resistance from hardware and BIOS makers. Many already contend that creating free BIOS software just for the sake of its being free has limited value to computer users. Executives at BIOS makers and chip giant Intel argue instead that today's tightly controlled model helps maintain PCs' security and stability, and fosters competition by protecting companies' intellectual property.

"Neither you nor I, as a user of a computer, has any reason to change the BIOS...unless it's broken," said Jonathan Joseph, chief executive of BIOS maker Insyde Software. "You're not going to type any faster in (Microsoft) Word because you have a new BIOS. The only thing you hide in BIOS is broken hardware."

"It puts me in an ethically compromised position to have a non-free program in my machine."
--Richard Stallman
President, Free Software Foundation

Others say that a very good reason to keep the BIOS closely held is to defend against hackers.

"The one thing we have to worry about first is security. What do you think would happen if there was a virus that started reflashing," or rewriting, BIOS software, said Mike Goldgof, senior vice president of marketing at Phoenix Technologies. "If it ever happened on a large scale, I think a lot of PCs would start turning into bricks. What people take for granted...is the reliability of the (BIOS) firmware today."

Intel has proposed a middle ground of sorts by opensourcing technology it calls Tiano. Tiano is its implementation of a framework for creating a BIOS replacement, with its own set of drivers to turn on elements of the PC such as the processor, based on EFI. Committing it to open source means others will be able to download it from a Web site called TianoCore.org and use it to make products under the Berkley Software Distribution, or BSD, license. The BSD will allow anyone who uses it to change it and create products out of it. But it does not require they provide the changes they made to others via open source, which provides the means to help companies protect intellectual property.

The effort by Intel creates a framework for a BIOS replacement, and thus could become the basis for free BIOSes. But it leaves the work of writing the code that initializes PC components to the downloader. One licensee likened it to having to build a race car. Intel, he said, provides race rules and the car's frame but leaves licensees to do their own engine, suspension, body work and other elements if they want to enter a race.

'Evil' companies?
Stallman argues instead that Intel is not doing enough and BIOS makers are not needed. Instead, he wants information.

"We're not wanting to do anything with the BIOSes from Phoenix or any of the others," he said. "We're not asking them to do anything, any more than we're asking Microsoft to do anything. These (companies) are evil. You can't expect them to do anything just because you ask them to. Our goal is to escape from them."

Thus, the free BIOS effort, as Stallman sees it happening, will essentially bypass traditional BIOS makers and instead focus on appealing to hardware manufacturers. The campaign will ask those companies, including PC makers and motherboard makers, to make available specifications on their products to allow free software writers to create BIOSes for them.

Stallman also dismisses rebuttals that free BIOS would compromise a PC's security, stability or reveal companies' proprietary chip, motherboard or other product information.

"Each one could be saying, 'If the others knew what we were doing, it would help them tremendously.' It might be true in a few cases, but it's impossible in all cases," Stallman said. "They can't all be sitting on secrets that are beyond the ken of their competitors. They can't all be the ones that know more than everybody else."

Moreover, detailed chip and motherboard information will not be required to create a free BIOS, he said. Instead, free BIOS makers would need access to closely held instructions, such as how a BIOS loads and how it initializes various devices inside a PC.

A free BIOS would also help circumvent, if necessary, digital-rights management, allowing people to run any software they choose on their PCs. In theory, the BIOS can be used to aid security technology, as it initializes hardware such as security chips.

Although BIOS makers and Intel say the BIOS' role is limited to helping get those elements of a system up and running along with the rest of it, a BIOS writer could write around them in order to shut them off, if needed, Stallman said.

"DRM is theft," he said. "The idea of the free software movement is you should be in control of your own computer. Treacherous competing (his term for so-called trusted computing) is a scheme to make sure you're not in control."

Ultimately, the free BIOS would emulate software such as the LinuxBIOS-- a free BIOS that's already in existence for Linux, but does not work with a large number of PCs--on a much broader scale.

"It's generally known that free software is very secure and very reliable," Stallman said. "If there's a bug in the BIOS, the only thing that will happen is some part of your machine won't work and that bug would be quite noticeable and it would be fixed, presuming that the information was available."

But that's the rub. Detailed specifications on cutting-edge PC hardware may be tough to come by. The information given to BIOS makers now is granted under nondisclosure and it's not clear whether companies such as Intel, PC makers like Dell, or motherboard makers would reveal even a little bit of information.

"You'd need to know the confidential information about the chips to write" a free BIOS, Insyde Software's Joseph said. Right now, "that info is only available on old hardware that nobody really cares about anymore."

That, however, won't stop Stallman from asking.

  • Talkback
  • Most Recent of 84 Talkback(s)
Read here then you will know
http://news.zdnet.com/2100-9595_22-514464.html?legacy=zdnn... (Read the rest)
Posted by: jcstevs Posted on: 04/27/05 You are currently: Logged In | Log out
Standards Roger Ramjet   | 04/05/05
This may be the most moronic statement of the day. ShadeTree   | 04/05/05
Not Really Roger Ramjet   | 04/05/05
The processor and the chipset internal make up ... ShadeTree   | 04/05/05
Interface != Implementation rpmyers1   | 04/05/05
ATI and Nvidia communicate through the ... ShadeTree   | 04/05/05
Re: Standards osreinstall   | 04/05/05
Call of the wild for BIOS Loverock Davidson   | 04/05/05
RMS's biggest problem Michael Kelly   | 04/05/05
Intel shows they don't get it rpmyers1   | 04/05/05
You show you don't get it! ShadeTree   | 04/05/05
Wrongo! Roger Ramjet   | 04/05/05
Then the fact the BIOS is closed ... ShadeTree   | 04/05/05
I'd think it's easy to break... Sotek   | 04/05/05
BZZZT rpmyers1   | 04/05/05
Nobody said it was all you should count on. ShadeTree   | 04/05/05
OK, so it's obscure rpmyers1   | 04/05/05
Never been hacked! ShadeTree   | 04/05/05
Hacked. Letophoro   | 04/05/05
Wrong again ShadeTree   | 04/05/05
RE: Never been hacked! Linux User 147560   | 04/05/05
Re: Wrong again. Letophoro   | 04/05/05
re: Letophoro ShadeTree   | 04/05/05
Re: ShadeTree Letophoro   | 04/05/05
re: re: Letophoro ShadeTree   | 04/05/05
Re: ShadeTree - Read the link again Letophoro   | 04/06/05
Letophoro ShadeTree   | 04/06/05
Re ShadeTree Letophoro   | 04/06/05
Yes, it has been proven to be flawed! CobraA1   | 04/05/05
Since obscurity doesn't afford any protection ... ShadeTree   | 04/05/05
Obsucrity offers no protection voska   | 04/05/05
If that were true then explain why ... ShadeTree   | 04/05/05
Stallman's a quack voska   | 04/05/05
Please provide a link to a single ... ShadeTree   | 04/05/05
Sorry not going to provide you with Malware voska   | 04/05/05
Please provide a link to an article ... ShadeTree   | 04/05/05
you do the research voska   | 04/05/05
The BIOS Virus protection you reffer to ... ShadeTree   | 04/05/05
Okay ShadeTree, heres your sign... Linux User 147560   | 04/05/05
RE: Linux User ShadeTree   | 04/05/05
Let's contrast these: Sotek   | 04/05/05
Works for Area 51 osreinstall   | 04/05/05
I've never seen or heard of a BIOS virus, have you? No_Ax_to_Grind   | 04/05/05
But you'll agree that Michael Kelly   | 04/05/05
Nope, I don't agree at all. No_Ax_to_Grind   | 04/05/05
How to wack a bios osreinstall   | 04/05/05
Oh, he admitted it rapson   | 04/06/05
Don't understand Microcode? jcstevs   | 04/27/05
Actually, yes... ab@...   | 04/05/05
Read here then you will know jcstevs   | 04/27/05
NT What about AMD? ab@...   | 04/05/05
In the end you'll NEED complete vendor support Michael Kelly   | 04/05/05
Dead MB with voided warranty maxo_z   | 04/05/05
$50? Michael Kelly   | 04/05/05
Re:$50? richdave   | 04/05/05
Agreed Michael Kelly   | 04/05/05
Easy to prevent flashing viruses AND... maxo_z   | 04/05/05
Hardware Already Exists rpmyers1   | 04/05/05
You are incorrect sir! ShadeTree   | 04/05/05
These postings reflect poor judgement ONEstar   | 04/05/05
You're optimistic rpmyers1   | 04/05/05
Ok....so what about the avg. user? step2000   | 04/05/05
OpenFirmware would be a great standard to use hipparchus2000   | 04/05/05
Calling OSI John L. Ries   | 04/05/05
This quote says it all.... Sir_Chancealot   | 04/05/05
Realizing the dream ... George Mitchell   | 04/05/05
More than a decade ago... Omch'Ar   | 04/05/05
I don't see the issue at all? No_Ax_to_Grind   | 04/05/05
Good catch rapson   | 04/05/05
Info for nothing John L. Ries   | 04/05/05
So where is the problem. No_Ax_to_Grind   | 04/05/05
The problem is Michael Kelly   | 04/05/05
Why would Joe Average ever want this? No_Ax_to_Grind   | 04/05/05
this whole thing is overblown hipparchus2000   | 04/05/05
It's not *their" hardware... John L. Ries   | 04/05/05
Your ownership of the hardware means... ShadeTree   | 04/05/05
If I remember correctly... rapson   | 04/06/05
About damn time too.... M_c   | 04/05/05
Absolutely! ShadeTree   | 04/06/05
I own the hardware but: osreinstall   | 04/05/05
Free BIOS mvorel   | 04/07/05
i want to know everything about my new car. i want to know everything about wessonjoe   | 04/08/05
Good luck on those GM blueprint requests osreinstall   | 04/08/05
i remember the old ibm pc and it's virus problems. i think this is a good wessonjoe   | 04/08/05

What do you think?

advertisement
advertisement