Hey @Matt_Hartley thanks for the update. Do you have answers to my questions from August yet?
Iāll ping ya there. - DMād ya. The idea here is to keep these threads on focus - releases and beta testing. Thanks
All,
This will be the last reply on this thread until we have an update.
Not the support or warranty period. The standard grace period given by security researchers to vendors before a vulnerability is publicly disclosed whether itās been patched or not is 90 days.
(This is a compromise between, on one hand, immediate full disclosure, which is fair but also sends everybody scrambling to patch and gets users harmed in the meantime; and, on the other hand, allowing the vendor to dictate the disclosure timeline, which historically had by many of them been taken as license to extend it indefinitely for literal years. Declaring a deadline in advance preempts accusations of extortion. The specific value is largely arbitrary, of course, but this one is reasonable and commonly accepted.)
Just a note that we have not forgotten about you. At this time, this last post from Nirav outlines the process weāll use when weāre ready.
Does āwhen weāre readyā mean the dedicated supplier post-launch support team that Nirav described two months ago is in place and working on the update but the update isnāt ready, or does it mean resources to work this arenāt even in place yet (as alluded to by the āsmall teamā comment)?
I feel bad ranting about this issue. I love the Framework hardware and the ethos it embodies. I still believe that sustainability is more than just a marketing ploy to the Framework team. But inaction has challenged that perception to the point where Iām seriously on the verge of selling my Framework and finding a better supported and/or more open alternative.
I feel bad ranting about this issue. I love the Framework hardware and the ethos it embodies.
I feel the same. But for me it is not just inaction, but also lack of communication and the communication style.
There was no clarification whether the contract is only negotiated or is already in-place. Since nothing happened in the last 2 months, I have the impression the wording was ambiguous by intention.
Iām still on BIOS 3.04 - now that we are talking about testing 3.08, is there anything in between that I should have updated to?
I remember 3.06 got scrapped, but now Iām wondering if I just overlooked 3.07 because I stopped visiting this thread often.
now that we are talking about testing 3.08
Im sorry to tell you, but noone is talking about testing 3.08.
There is no 3.07.
3.06 is still the lastest available Beta BIOS and we got no ETA for a new version
There has only been a 3.06 version made available (for 12th gen intel models), as a beta. The installation is apparently a bit unreliable, and un-reversable, may require some perseverance - view reports above. There was a vague report from a framework employee of a later version, in early summer, but the EFI/linux installer for it reportedly didnāt work, and Iām guessing it had other issues, because it was never made available. It seems like attempts have been made, but they just canāt get a āgood enoughā release together, so far.
I donāt own a 12th gen intel model, but I started browsing the forums and found this thread shortly before I received my AMD model that I pre-ordered in the spring. I like it, and I still love Framework, but man, this firmware release situation sucks, it truly does.
For what itās worth: work on the 13" AMD model, and the 16" model, started before this 3.06 beta firmware for the 12th gen intel was released. Iām guessing that it was really not economically viable, for a startup like Framework, to pause that release train in order to focus on intel 12th gen firmware.
Anyway, my sincere hope (and I still do have hope) is that Framework have learned the lesson that firmware is very difficult and expensive. Theoretically, it should be easier than hardware, but in practice, not really. Iāve worked on firmware before, and Iāve worked on server-side data processing for a small division of a big hardware company, that is kinda infamous for bad software (but great hardware), and Iāve reviewed firmware written by teams in asia ā¦ and I really could rant for hours. But I think the take-away is that, hardware companies know that the hardware has to be validated before production, every little trace has to have been worked on or reviewed by a hardware engineer that truly knows their s***. But software, we can just patch it up and fix it later! The team is following industry-standard best-practices! Well now you know, not so easy, you might actually have a problem harder to fix than the entire hardware design, anything is possible. It will just take a while longer to get teams spun-up, they should have started 18 months ago, but alas ā¦
Iām guessing that it was really not economically viable, for a startup like Framework, to pause that release train in order to focus on intel 12th gen firmware.
The āweāre a scrappy startup without the resources to maintain firmwareā argument isnāt acceptable. They donāt tell customers with hardware warranty issues āWeāre busy with the Framework 16 right now - weāll get back to you in a year or two.ā Full lifecycle support (hardware and firmware) should be factored into the business plan from the beginning. An understandable oversight on the 11th gen? OK, correct it on the 12th gen. That obviously didnāt happen and thereās no evidence that 13th gen/AMD are any different (anyone seen status, or even acknowledgement, on a LogoFail fix for 13th gen/AMD?).
Is it difficult/expensive? Perhaps. Itās more difficult/expensive when choices are made to rely exclusively on proprietary 3rd party firmware. Getting a Framework with BootGuard disabled isnāt possible, so the community is completely locked out of the process. If CoreBoot was even an option on the Framework (Iām not advocating for it to be default, just an option) we would have an active firmware development community that would cost Framework almost nothing.
I have been willing to cut Framework some slack because they are a small company challenging some bad industry practices. But the lack or openness on firmware support (despite the fact that they can send me weekly spam on how great the Framework 16 design is) has exhausted my patience.
Can things be improved? Sure. If you feel that a different vendor is more fitting for you, vote with your feet. The points are legitimate, but the incessant bitching is too much. You signed up with a startup, deal with it or move on.
Have a good day.
[Has] anyone seen status, or even acknowledgement, on a LogoFail fix for 13th gen/AMD?
There has been an acknowledgement, yes:
Based on analysis from Binarly, we believe each of our currently launched platforms except Chromebook Edition is vulnerable to some form of LogoFAIL. We are working with our upstream UEFI supplier, Insyde, in order to get the necessary update from them to resolve this. This is occurring as part of our sustaining software initiative.
Are the accounts on here that just say - āframeworks a startup, deal with it or move onā -just framework employees with seperate accounts?
Not mine. Is yours?
INB4 they lock this thread again.
team of rock stars undertaking a herculean effort as we make amazing products.
Yes, you folks are rockstars. I appreciate the patience you must have with some of us. and the creativity to design, program and publish hardware, software and documentation.
The standard grace period given by security researchers to vendors before a vulnerability is publicly disclosed whether itās been patched or not is 90 days.
gotcha, thx. Ive read before that these may in some cases be extended, unless emediate action due to other reasons OR non cooperative vendors and other reasons. 90 days it probably is
now that we are talking about testing 3.08
I was imagining .08 based on them working on .07 before the LogoFAIL vulnerability. I have no insider knowledge and they might release .07 with all these patches applied. sorry about the confusion
If CoreBoot was even an option on the Framework (Iām not advocating for it to be default, just an option) we would have an active firmware development community that would cost Framework almost nothing.
this may be still in the works, its where my hope is anyway. untill then, I hope for 3.06 or a stable 3.07.
(anyone seen status, or even acknowledgement, on a LogoFail fix for 13th gen/AMD?).
I havenāt seen that anyone has a fix available, but FW have acknowledged the problem and that Insyde are working on a fix. And I would expect that fix will be for ALL manufacturers that Insyde supply, not just FW, as it is a general problem with the BIOS, not just a problem for FW.
And I would expect that fix will be for ALL manufacturers that Insyde supply, not just FW
A fix to Insydeās baseline doesnāt help Framework owners until someone merges it into each Framework branch and goes through the build/test cycle. Getting Insyde to fix major CVEs isnāt a huge challenge. Getting those fixes into a Framework firmware update seems to be a different story.
But Iāve been on this soapbox too long already. If, as many have stated, I simply shouldnāt expect timely post-launch firmware support from a startup like Framework, then I guess my path is clear.
then I guess my path is clear.
āthis isnāt an airport; you donāt have to announce your departureā or better, what does your reply constructively add to the current conversation?
EDIT:
Itās funny youāre latching onto this particular reply, since most of the messages in this topic (likely including some comments of my own from a while back) arenāt particularly constructive.
something snapped, instead of keeping my mouth (keyboard) shut for many many replies, I want a constructive thread and if i see an update in my mail. I finally wanted to say something, not only to David, but all those āif this continues, then ill leave/shop elsewhereā.
Id much rather see a message about the status of said beta or upcoming new version. another complaint is not fun and not very helpful. Your reply is describing as-well how I feel, and worded nicely. including the last paragraph. hopefully earlier (in a positive way), but in this thread, have a great new year and other festivities .
what does your reply constructively add to the current conversation?
Itās funny youāre latching onto this particular reply, since most of the messages in this topic (likely including some comments of my own from a while back) arenāt particularly constructive.
I know Iām probably only contributing to the problem here, but: can we just stop? Framework isnāt going to give us more updates until they have something substantive to say, and whining about that fact isnāt going to change anything, if all the prior whining about it is any indication.
I get the desire to vent about the situation (Iām pretty upset about it myself), but subscribing to this topic has become about as useful as spam. When I see a notification email about it, I no longer think āoh, cool, maybe thereās an updateā, but instead assume itās just someone complaining about the lack of updates, which is boring, uninteresting, and doesnāt constructively add to the current conversationā¦ to borrow the phrase.
So can we all please just stop posting here? Iād be really happy if the next email notification I get on this topic is about a new beta release, not more complaining about the lack of oneā¦ even if that joyous notification doesnāt come for another year, thatād still be much nicer.
The fix here isnāt for people to stop posting their thoughts, worries, and expectations. The fix to bring constructive discussion into this thread is for framework to start supporting their sustainable products. After a year and 3 additional product launches I think we have all paid our dues in money and patience to be allowed to express our frustration.