4 ms·

This is great, I love the idea of building a complete laptop from the ground up to dispel all the "magic" that goes on inside a manufacturer built consumer mode

by dcw303 11y ago

This is great, I love the idea of building a complete laptop from the ground up to dispel all the "magic" that goes on inside a manufacturer built consumer model. Hypothetically speaking, if I was a super-paranoid type who wanted to build my own laptop from scratch so that I trusted every component installed, how would I go about verifying the CPU / SOC was not a threat? I guess I'm asking if there's anything equivalent to an MD5 checksum for hardware? It seems that backdoors are being discovered in parts as esoteric as hard drive controller firmware, so I'm wondering if it's practical to believe I could build a personal computing device that is trustworthy.

verbify 11y ago
According to Ken Thompson's lecture at his Turing Award, you can't: https://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thompson.pdf https://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thomp... Practically speaking, you can verify that it's unlikely that there is no backdoor, but it'd take a fair bit of effort.
- zachrose 11y ago
  Impractically speaking, you could singlehandedly reimplement decades of computer engineering starting with a pencil, paper, and a bucket of sand.
  - stcredzero 11y ago
    From NAND to Tetris in 12 steps https://www.youtube.com/watch?v=IlPj5Rg1y2w https://www.youtube.com/watch?v=IlPj5Rg1y2w
  - ender89 11y ago
    I prefer placing rocks in an infinite desert to simulate the the flow of data through a computer myself.
zymhan 11y ago
The best you can do is use a processor with an open-source design. Stallman used a MIPS CPU like this for a while.
- Sanddancer 11y ago
  The processor Stallman was using wasn't open-source. The MIPS instruction set was opened up, but most of the implementations weren't.
- jimktrains2 11y ago
  But what about fabbing or the PLC? Can you verify those? or disk controllers, &c.
  - agumonkey 11y ago
    Bunnie huang also showed that even sdcards have potent microcontrollers ..
fleitz 11y ago
Model your threat and then mitigate it, for example if you are worried about China buy an Intel CPU made in the US, if you are worried about the US buy Huawei gear. Lets just leave it at you don't posses the budget to make any reasonably legitimate claims about your op sec. If one of your use cases is browsing the internet, you might as well just give up. If they can put stuxnet on Iranian PLCs you're fucked, however, in reality no one really gives a shit about what porn you might be watching or whatever other irrelevant activities you might be doing.
- grubles 11y ago
  "Stuxnet functions by targeting machines using the Microsoft Windows operating system and networks, then seeking out Siemens Step7 software."[0] Needless to say, if you run Microsoft software, you're going to have a bad time. [0]https://en.wikipedia.org/wiki/Stuxnet https://en.wikipedia.org/wiki/Stuxnet

by dcw303 11y ago

verbify 11y ago

According to Ken Thompson's lecture at his Turing Award, you can't: https://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thompson.pdf https://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thomp... Practically speaking, you can verify that it's unlikely that there is no backdoor, but it'd take a fair bit of effort.

zachrose 11y ago
Impractically speaking, you could singlehandedly reimplement decades of computer engineering starting with a pencil, paper, and a bucket of sand.
- stcredzero 11y ago
  From NAND to Tetris in 12 steps https://www.youtube.com/watch?v=IlPj5Rg1y2w https://www.youtube.com/watch?v=IlPj5Rg1y2w
- ender89 11y ago
  I prefer placing rocks in an infinite desert to simulate the the flow of data through a computer myself.

zymhan 11y ago

The best you can do is use a processor with an open-source design. Stallman used a MIPS CPU like this for a while.

Sanddancer 11y ago
The processor Stallman was using wasn't open-source. The MIPS instruction set was opened up, but most of the implementations weren't.
jimktrains2 11y ago
But what about fabbing or the PLC? Can you verify those? or disk controllers, &c.
- agumonkey 11y ago
  Bunnie huang also showed that even sdcards have potent microcontrollers ..

fleitz 11y ago

Model your threat and then mitigate it, for example if you are worried about China buy an Intel CPU made in the US, if you are worried about the US buy Huawei gear. Lets just leave it at you don't posses the budget to make any reasonably legitimate claims about your op sec. If one of your use cases is browsing the internet, you might as well just give up. If they can put stuxnet on Iranian PLCs you're fucked, however, in reality no one really gives a shit about what porn you might be watching or whatever other irrelevant activities you might be doing.

grubles 11y ago
"Stuxnet functions by targeting machines using the Microsoft Windows operating system and networks, then seeking out Siemens Step7 software."[0] Needless to say, if you run Microsoft software, you're going to have a bad time. [0]https://en.wikipedia.org/wiki/Stuxnet https://en.wikipedia.org/wiki/Stuxnet