[Wesley W. Terpstra <wesley@te...>]

On Mon, Apr 4, 2016 at 8:42 PM, Alexander Duyck
<alexander.duyck@...> wrote:
> It is always possible that the SFP+ cages on the device may not dissipate
> enough heat for a given SFP+ module

If an SFP is capable of melting itself or other devices, that is the
fault of the SFP, not Intel's card, and not my unlocking of said card.
FYI, I have never seen such an SFP, and we use lots of different
models at my day job.

> when the device is under heavy use.

There is no "heavy use" for 10GBase.
You constantly transmit comma codes for clock recovery or the link goes dead.

> Odds are the card does have a fuse on it so it probably would just
> brick the card.  Still, intentionally circumventing the white list in
> the EEPROM puts you at a greater risk than just "bricking the card"
> there is always the potential for more catastrophic issues such as the
> risk of actually starting a fire.

While I agree there is a non-zero risk, it's EXTREMELY unlikely.

> I've seen things such as someone
> overclocking a graphics card and literally burning the network card in
> the slot next to it.

Overclocking a graphics card can increase power consumption a lot! You
are talking about parts that draw 200W during normal operation, and
god knows how much when they overclocked it. An SFP+ that draws 5W
would already be on the high end. There is no fire risk from 5W in a
housing that size, with thermal contact to the copper layers of the
card. The surface area is plenty.

> It is those kind of liability issues that lead to things like
> this white-list that Intel implemented in their EEPROM in the first
> place.

I don't believe that for a second.

If that were the case, then the low-margin bargain 10GBase cards would
be the ones implementing the SFP+ white lists.  However, the cheap
cards allow all SFP+s. Why? Because the legal jeopardy is so low that
even with their low margin, they don't care. It's no coincidence that
the two major bad actors (Intel and Cisco) also sell SFP+s.

> My concern wouldn't be so much about bricking the card as voiding the
> warranty for the entire system.  You should probably stress that this
> is "at your own risk" ... You might also want to throw a license on the code in the
> git repo so that you make it expressly clear you are not liable for
> any possible damages caused by the use of your code.  Probably
> something like a BSD license would suffice.

Yes, I should put a licence on it. So I suppose there will be an "at
your own risk" from that. However, I live in Germany. If you help
someone and do not charge anything for it, you can not be held liable
here. It's the "good samaritan law".

> ... the risks could extend beyond just the card
> itself as there is always potential for damage to other components in
> the system.

I suppose it doesn't hurt to say this, but I don't agree that there is
any real risk.

PS. Alex, sorry for sending this to you twice.