AFAIK, the Linux codebase is actually open source in its entirety. However it has parts that are capable of loading non-free stuff like firmware. The linux-libre project makes sure those parts are disabled.

Personally, I think it's a fool's errand as it would render most modern systems unusable (in the reasonable sense).

They also don't apply such harsh judgement to firmware that resides in ROM, and only to firmware updates. In most of these cases you'd have systems with outdated firmwares with neither QoL nor security updates.

Could we please stop associating open source with security? Don't get me wrong, I love open source software and it is easier to trust open source software than proprietary, because it is highly unlikely, that they hide stuff like trackers in there. It is also most of the time highly configurable and sometimes even hackable and as a software developer you are able to look into the mechanisms behind the APIs which is sometimes really helpful.

But events like the lzma incident last year and predictable openssl RNG in Debian some time ago (https://lists.debian.org/debian-security-announce/2008/msg00152.html) should tell us, that open source doesn't mean secure software. And the argument, that there are many people looking at the code is not really true. E.g. many maintainers of the linux kernel only look at specific parts/drivers in it and maybe into some other things they need for that. There are probably only a few people if any (apart from governments), that have read, understood and analyzed the linux kernel in its entirety with all the (open source) drivers built into it and all the possible combinations of configurations. And I don't want to know how many have done all that for less popular projects. And even if that is done at some point for an upstream project, you would have to check the patches from your distro and if there are any do it all for yourself again. And when the next release arrives you would have to do all that in its entirety again (although with some head start) if a new version arrives (that has, say, at least a thousand lines of code changed, removed or added). And now think about how many big releases come with some software per year. And don't forget to also include all the dependencies you have to check including the compiler and standard library of the language(s) used.

Of course it is easier to do all that for OSS as an outside party because you don't have to decompile it, but it is still increadibly hard. And only to be easier to analyze for security risks doesn't mean to be more secure just like packaging being recyclable doesn't mean that it will be recycled.

I could understand that some distros' kernel had binary blobs, but the main kernel?? I was not expecting that if it's true.

It's definitely not safer. It does not include microcode updates so it's quite the opposite of secure. Technically you can load them at boot but why would you intentionally make security harder to achieve?

Not including microcode updates is also extremely dumb from the philosophical standpoint. Microcode is closed source firmware running "inside your CPU" so if you don't include the updates, your CPU now runs on both vulnerable and proprietary firmware.

But that’s not how politics work, you always have to compromise somewhere

THAT IS how politics works. You have to always try to make as much noise in getting what you want with the hopes that once it comes to a compromise somewhere you end up in a better position.

The FSF has clear guidelines and follows them rigorously, nothing else. It's good that they don't make exceptions. Any problem with microcode or other proprietary drivers starts with the fact that they are not free. Making exceptions would partially solve the problem, but the situation would not change significantly, and the FSF would then be violating its own principles.

The FSF's job in this regard is to try to open debate about the problems of not having free security patches and, in any case, to try to uncover hidden vulnerabilities in proprietary tools and facilitate the creation of free tools that solve the problems.

You know anyone is capable of telling the same thing, but about proprietary code or about that stance you have? Not everyone has to follow the FSF steps nor LInux-Libre, they're there for people who want them and follows their principles. They do what they think is right and invest in that, you don't so you don't invest in that. I think it's great for them to work in projects like GNU Health, Linux-Libre or even Hurd (if it's even active) so we can see more free software development in the future and free software culture in things like health devices (which may or may not be inside your body). I agree with you about microcode, though, but I think AMD is working on opening some microcode in their GPUs (I'm not sure about CPUs), which is great! You can just do your own thing, I prefer to use free software when I can and settle with proprietary code I can't change, other people likes to settle with proprietary systems and a small group likes to force free software in everything they can. I can still help with donations, reporting issues (my favorite part about FOSS/OSS is clear communication) and helping the community until I'm knowledgeable enough in programming.

Btw, I don't think we have to always settle, we can still fight and get things changing for the better. It may take some time, but I think it's worth it.

yeah well thats hyperbola, they are generally known to be extreme to the point of nonsense. If you want a good free-software only distro try guix. They apparently have the third largest software repo in existence. They have an unofficial non-free repo too.