Librephone battles the proprietary binary blob

Free Software Foundation project aims to reverse-engineer non-freedom respecting firmware

To bridge the gap between Android distributions and true mobile phone freedom, the Free Software Foundation (FSF) has launched an initiative called Librephone.

It's not an attempt to build yet another mobile operating system. Rather, the goal is to develop replacements for proprietary blobs – binaries without associated source code – in Android device firmware that limit software freedom technically or legally.

Google's Android operating system and Apple's iOS both limit that freedom through contractual rules and intellectual property rights. While alternative mobile operating systems exist, often distributions based on the Android Open Source Project (e.g., LineageOS), they may contain proprietary blobs related to specific vendors (e.g., Qualcomm). Such blobs, which often handle functions related to networking and wireless communication, are governed by software licenses that limit the sharing or modification of code.

The FSF says it wants people to have the freedom to inspect, alter, and share the source code for mobile phone firmware and applications. 

"A lot of work has been done in mobile phone freedom over the years that we'll be building on," said Zoë Kooyman, executive director of the FSF, in a statement. "The FSF is now ready to do what is necessary to bring freedom to cell phone users. Given the complexity of the devices, this work will take time, but we're used to playing the long game."

The aim of the Librephone initiative is to reverse-engineer various proprietary blobs so FOSS versions of the code can be created and used in place of freedom-limiting bits. 

Not everyone wants the FSF seal of approval. The makers of AOSP-based GrapheneOS – which the FSF has declined to endorse – have argued that GNU/FSF approval is not a goal because the FSF's stance on firmware updates is fundamentally insecure.

"We don't want their endorsement since it simply means an OS is insecure," a GrapheneOS administrative account said in a forum post last year. "They even require removing security warnings about insecure out-of-date firmware/microcode because they consider it promoting non-free software. That's scammer behavior. We want nothing to do with it."

The Librephone project is backed by FSF board member John Gilmore, who explained in a statement, "I have enjoyed using a mobile phone running LineageOS with MicroG and F-Droid for years, which eliminates the spyware and control that Google embeds in standard Android phones. I later discovered that the LineageOS distribution links in significant proprietary binary modules copied from the firmware of particular phones. Rather than accept this sad situation, I looked for collaborators to reverse-engineer and replace those proprietary modules with fully free software, for at least one modern phone."

With Gilmore's funding, the FSF has hired developer Rob Savoye, who has contributed to various GNU/Linux projects such as GCC, GDB, DejaGNU, Gnash, and Autotools.

Savoye told The Register in an email that initially he intends to focus on binary blobs associated with radio functions, cellular connectivity, Wi-Fi, and Bluetooth. After that, he expects to be looking at GPU functions, and blobs associated with touch screen interaction and media playback.

He's not sure how long the project will take. "This will be a multi-year effort," Savoye said. "It's impossible to propose a timeline as that's dependent on resources like funding and developers. To really get this done in a reasonable amount of time is going to require developers working in parallel."

Asked whether Google's recently announced plans to limit Android app distribution played a role in the launch of the Librephone project, Savoye said it hadn't.

"My initial discussions with the FSF pre-date that announcement," he said. "John Gilmore and I have talked about this for ages, but it had to wait till I had the time freed up from other work. I'm not trying to build a free mobile OS, just freeing up the low-level layer that controls the hardware. Any of the mobile operating systems would be able to use any replacements for the binary blobs."

Savoye said he expects the most significant technical challenge to be the obstacles smartphone makers have put in place to make reverse engineering difficult.

"For example, I can't even get datasheets on the chipsets," he said. "Then throw in things like Secure Boot, Trusted Computing, and layers of firmware signing. In addition there are also legal issues to be conscious of here in the US, namely the DMCA and FCC regulations. The real challenge is to work around all these issues in a legally conforming way."

For those disinclined to wait, there's the FSF-blessed Purism Librem 5. ®