I support Louis Rossmann’s fight for right to repair, but he left out a huge amount of context in his two videos on Purism, and that context is important in trying to evaluate the actions of Purism as a company. There is a lot of moral complexity that Rossmann totally ignores in his simplistic characterization of Purism as a “scam”. Rossmann doesn’t address the tricky economics of developing mobile Linux and mobile Linux devices and he totally fails to address the good that Purism is doing in the world by developing mobile Linux.
Purism’s refund policy for preorders deserves public criticism, so I have no problem with Rossmann calling out the company. However, I don’t think it is acceptable to criticize the company without acknowledging the dilemma that Purism was in. I appreciate the fact that Rossmann read the text of the email that he received from a Purism employee, because Purism should have publicized that information long ago, but Rossmann totally failed to address the real issues laid out in that email. Instead, he focused on lambasting the spiritual journey of the emailer and how he was presenting himself as a good guy and how Rossmann felt that the emailer was trying to manipulate him into deleting his previous video. Frankly, none of that addresses the real issues at hand.
From what was stated in the email, if Purism had repaid all the refund requests, it would have had to cancel the development of the Librem 5. Based on the fact that Purism changed its refund policy in late February or early March of 2020, Purism had already spent a large amount on the development of the Librem 5 (probably the majority of the roughly $2 to $3 million in preorders), and I’m pretty sure that the company wouldn’t have been able to refund all the preorders for the Librem 5 at that point in time.
Legally, Purism should have kept paying out refunds until it went bankrupt, however, in bankruptcy proceedings, the bankruptcy judge is likely to prioritize employees owed back pay and creditors (and maybe stockholders) before customers, so it is highly likely that most of the people who preordered would not have gotten refunds if Purism had done what Rossmann demands. By delaying the repayment of refunds, Purism was able to continue the software development and ship the hardware, so the majority of its customers would not take a loss.
If Purism had announced publicly that it was having financial problems in early 2020, then it would have guaranteed that orders for its products would have dried up, and the company would have no hope of ever being able to refund the cancelled orders with new orders.
According to the email, Purism is still trying to refund the cancelled orders with money from new orders, which will be a slow process, since Purism is a low-volume business. If that is the case, people who cancelled their pre-orders will eventually get their refunds, but they will have to be prepared to wait a long time for the refund. However, purismRscammers has posted that Purism now won’t let him/her get a refund, and Rossmann’s previous video stated the same.
In my opinion, Purism needs to publicly state what its policy will be for cancelled preorders, because this situation leaves everyone in doubt. If it intends to eventually refund customers when it has the funds available from new orders, then let customers know that that is its policy. If it doesn’t ever intend to refund the cancelled preorders (except with credit to buy other products), then Purism should state that, and explain its financial problems. I can understand if Purism doesn’t want to share its financials, but it can explain losses without stating exact amounts.
At this point, Purism has stated that it will not be using crowdfunding any more to develop new products, so Purism should issue a guarantee to ship orders or return customer’s money for all future orders to reestablish the credibility of the business. I would recommend that Purism issue a surety bond, to reassure customers that new orders will be shipped, because if they aren’t shipped, then customers will get their money from the bond. Some people will never order another Purism product based on the bad publicity from this event, but I think that a lot of customers are willing to keep buying from Purism if they have a strong guarantee that they won’t take a loss when ordering new products from Purism.
Another thing that I recommend is that Purism publicize how much it has invested in the development of mobile Linux, so Rossmann can’t make the ignorant argument that preordering the Librem 5 is like Rossmann Group receiving an order for parts or a Macbook to be fixed. The only other company doing serious dev work for mobile Linux is Jolla, and its Sailfish OS will never be widely adopted by the community due to its proprietary Silica interface and the proprietary Alien Dalvik virtual machine to run Android apps. Give Jolla credit for maintaining components like the libhybris Android driver compatibility layer, oFono telephony and the Maliit keyboard, but libhybris and oFono are no longer important now that Plasma Mobile has abandoned the Halium framework. At this point, Purism’s work on Phosh is far more important for the future of mobile Linux, considering that Phosh is the most popular mobile Linux interface according to Pine64’s poll and libadwaita has become a standard part of GNOME to make it adaptive and touch friendly. Almost all the major Linux distros now include Phosh, which is probably why Juno used Phosh when showing off its new Juno Tab 2 tablet to get preorders.
I count 344k lines of code in the software projects that Purism created for the Librem 5:
Lines of code in Purism's projects for the Librem 5:
libhandy: 48016
libadwaita: 89530
calls: 29332
chatty: 46170
squeekboard: 22109
libcall-ui: 4688
phoc: 23882
phosh: 66779
feedbackd: 7065
feedbackd-device-themes: 370
gtherm: 1734
haegtesse: 2081
wys: 2401
Total lines of code: 344157
In addition, Purism has made about 200 commits to the Linux kernel and added code to roughly 20 GNOME apps to make them adaptive, plus all the work on Coreboot, Pureboot, Librem-EC and Laniakea. If we look at the amount of code that has been created by the other small Linux hardware vendors (System76, TUXEDO Computers, PINE64, FydeOS, Juno Computers, Slimbook, Vikings, Ubuntushop.eu, RetroFreedom, Entroware, StarLabs, laptop-with-linux.com, MALIBAL, Libiquity, CompuLab, ODROID, Lemote, Raspberry Pi, Seeed, etc), I doubt that all of them added together have contributed as much code to FOSS projects, and most of their code is only for their specific hardware, rather than hardware-agnostic code for GTK/GNOME which can be used by many distros.
Rossmann seems to be largely clueless about mobile Linux, and to have no idea what happened to previous attempts to create mobile Linux devices. The sad reality is that there have been 20 previous attempts at commercial mobile Linux before Purism tried it. Sharp, Wind River, Montevista, Panasonic/NEC, Nokia, Motorola, Intel, Mozilla, Canonical, Jolla, Samsung and Palm->HP->LG all failed trying to bring mobile Linux devices to market. This history has taught all the Linux hardware vendors that they should do as little software development as possible except code to make their hardware work and some distro maintenance.
Does Rossmann want the Librem 5 to end up like all the junked Firefox OS devices, which stopped getting software updates from Mozilla Foundation after 2015? Does he want the development of Phosh to end up like Ubuntu Touch’s Lomiri, which has only had 7 commits in the last year because Canonical dumped the code on the community? Does he want the Librem 5 to end up like the Jolla C tablet, where the company went through bankruptcy and the people who preordered lost their money? Does he want Purism to go bankrupt like the company behind the JingPad, where the users got their hardware, but the software was abandoned? The first Juno Pad will probably never have a working back camera, and the PinePhone Pro and PineNote are still unusable. Does Rossmann really think that mobile Linux is going to be successful without having paid software developers?
As far as I can tell from Rossmann’s comments in his two videos about Purism, he doesn’t seem to care a wit about mobile Linux. His advocacy of an AOSP derivative like GrapheneOS shows no awareness of how dependent AOSP is upon Google. If Google ever perceives AOSP as a threat to its market share, it will stop releasing new versions of AOSP and effectively kill all the derivatives like LineageOS, GrapheneOS, Calyx OS, etc., because old versions of AOSP won’t be able to run with the proprietary drivers for future chips from Qualcomm, MediaTek, etc.
Rossmann spends a lot of time in his YouTube channel talking about the right to repair and the fact that we need access to the schematics and the software tools in order to fix devices. The Librem 5/USA/Liberty is the first phone with free/open source schematics since the Golden Delicious GTA4 in 2014, and as far as I know, the GTA4 didn’t release a board view/wire drawing of its circuit boards like the Librem 5, so it would have been very hard to do the kind of board-level repair that Rossmann advocates. The PinePhone and PinePhone Pro are the only other phones on the market today which publicly release their schematics (although they are proprietary), but PINE64 doesn’t publicly release board views/wire drawings to do repair of the circuit boards. By attacking Purism, Rossman is attacking the only phone on the market with publicly accessible board views/wire drawings. He also is attacking the only phone on the market that allows the cellular modem and Wi-Fi to be easily exchanged.
By advocating that people use GrapheneOS, Rossmann is basically telling people that they should buy Google Pixel phones, because GrapheneOS only officially supports the Pixel 4 - 7. In other words, Rossmann is advocating that people should buy hardware which is only good for a couple years and use an OS that stops supporting the hardware the moment that Google decides to stops releasing security updates for that hardware.
How exactly is Rossmann advocating for the right to repair with this position on Purism? If Rossmann truly believed in the principals that he claims, he would be telling people to support the development of mobile Linux, because it will allow people to use their mobile devices indefinitely and still receive software updates, and he should be telling people to support Purism, because Purism releases schematics and board views and designs phones so critical parts can be easily replaced.
Rossmann mocks people who believe that they are doing good. While he is right that some people use their belief in their own goodness to justify their evil actions, he makes no attempt to weight the benefits and detriments of Purism’s actions, and try to make a judgment call about whether Purism is actually promoting good in the world or not. I would have more respect for his position if he weighed the good vs the bad, and decided that Purism’s actions caused more harm than good in the world, but he utterly ignores what Purism is trying to do and makes no attempt to judge whether the software dev work and the production of the Librem 5 has any positive benefit for the world. Rossman makes no effort to evaluate what effect a Purism bankruptcy would have. He doesn’t ask the difficult question where mobile Linux will be without the dev work on Phosh and whether Plasma Mobile with 100% volunteer development is the best route to advance user freedom in the world, in the face of the Android/iOS duopoly.
As I pointed out in the community FAQ, there are areas where Android and iOS do offer better security than the Librem 5 with PureOS (such as kernel hardening and user space protection), but Rossmann focused on areas which frankly make no sense. The Synopsys DDR4 memory initialization blob in the Librem 5 may violate the spirit of the FSF’s RYF requirements, but I don’t see much evidence that it is a security threat. It isn’t hard to verify that the four proprietary files from Synopsys stored on the Winbond W25Q16JVUXIM TR SPI NOR Flash chip are the same as the standard ones distributed by NXP, so you can verify that they haven’t been tampered with. At the point in the bootup sequence when those four files are executed by the separate ArcCore processor, almost nothing on the device is functional and those 4 files only contain 55KB, so it would be nearly impossible to do something malicious like bring up the cellular modem and load a TCP/IP stack or try to write a file in the Flash memory.
Rossmann claimed that the Librem 5’s kill switches can’t stop a vibrating device being used as a microphone. He clarified in the comments of his first video that he was talking about this theoretical exploit using a gyroscope. However, activating the three kill switches in the Librem 5 does turn off the gyroscope, so Rossmann is wrong. Moreover, I can’t find any example of this exploit in the real world, and critics have pointed out that the vibration in a gyroscope probably isn’t strong enough to actually record a normal conversation, so this isn’t a real security threat as far as I can tell.
The third thing that Rossmann cites is that the USB ports in the Librem 5 are unsafe, and Rossmann linked to this thread on YCombinator where marcan_42 says that the Librem 5 has no description filtering for the USB connection used by the cellular modem. I don’t know where to check this, so marcan_42 may be right about this point, but it is worth pointing out that Debian does close the USB description filtering security vulnerabilities when they are reported and the USB 2.0 used by the cellular baseband and the USB 3.0 port on the bottom of the Librem 5 don’t support direct memory access.