Digital Restrictions and Security Leftovers

posted by Roy Schestowitz on Dec 22, 2022

• (Software) Repair info on EnergyGuide labels: Conservancy replies to FTC's request - Conservancy Blog - Software Freedom Conservancy

  Software Freedom Conservancy has today submitted its reply to the FTC's request for comments on how repair information should be displayed on EnergyGuide labels. In particular, SFC has recommended that the FTC mandate a "Software Repair Instructions" section on the EnergyGuide labels that are already required on a variety of home appliances, including televisions, refrigerators, clothes washers, and dishwashers. This would not be a new notice requirement for most manufacturers, since it (currently) only requires manufacturers to provide the notice when they already had obligations under copyleft licenses to offer source code already. This merely changes the prominence of such notices, so that users can more easily see which products contain copylefted software (and thus software repair instructions) or not. This is important because many manufacturers make efforts to deemphasize or obscure their offers (if they have them at all), which prevents consumers from learning that they have rights with respect to their software.

  We are very happy to see the FTC requesting comments on how repair information for home appliances can be better provided to purchasers of these products. While the FTC's EnergyGuide labeling program started out as a way for purchasers to better assess how much energy each appliance would likely use, and approximately how much that would cost them, the FTC has been taking a more holistic view of how appliance purchases impact the world, not just in terms of how much energy they consume while operating, but also how much energy is required to manufacture them and, consequently, how we can reduce the number of appliances going into landfills, reducing the number of new appliances that need to be manufactured. Free and open source software provides many answers to these repair and longevity questions, and we hope that appliance purchasers will be made more aware of this through the FTC's updated labeling requirements.

• Conservancy submits comments to FTC for free software labeling - Software Freedom Conservancy

  As one of his first official acts as Director of Compliance, Denver Gingerich submitted a comment to the FTC on behalf of SFC proposing adding software Right to Repair instructions for copyleft software on appliances. In conversations with various Right to Repair organizations, we brainstormed how to submit to the new FTC request for comment for the EnergyGuide labeling system. Based on these discussions, we found that there is no organization or governing body requiring repair instruction labeling for software. Given how many modern electronics and appliances rely on copylefted free software, SFC recommended adding software repair instructions that include labeling that there is copyleft software on the device and including specific links to the source code and repair instructions on the manufacturer's website. These are already required by the license, but are often buried deep in a manual somewhere. Adding these instructions would extend the rights afforded by copyleft software to all users of hardware that rely on it.

• Huang: Towards a More Open Secure Element Chip [LWN.net]

  Andrew 'bunnie' Huang writes about his work with Cramium to bring more openness to secure element chips...

• The 2022 curl security audit | daniel.haxx.se

  Thanks to an OpenSSF grant, OSTIF helped us set up a curl security audit, which the excellent Trail of Bits was selected to perform in September 2022. We are most grateful to OpenSSF for doing this for us, and I hope all users who use and rely on curl recognize this extraordinary gift. OSTIF posted about this separately.

  We previously had an audit performed on curl back in 2016 by Cure53 (sponsored by Mozilla) but I like to think that we (curl) have traveled quite far and matured a lot since those days. The fixes from the discoveries reported in that old previous audit were all merged and shipped in the 7.51.0 release, in November 2016. Now over six years ago.