3 ms·

I had a system nearly like what the author describes after the internal SSD drive on my first generation Acer Aspire One died. There didn't seem to be an easy

by loudmax 11y ago

I had a system nearly like what the author describes after the internal SSD drive on my first generation Acer Aspire One died. There didn't seem to be an easy way to replace the drive with a generic SATA SSD (at least none that I was aware of), and a replacement drive was like $80. This is for a $200 netbook, and it wasn't a very good SSD to begin with. So I put Knoppix on a USB stick and basically used that. Since all my stuff is either on my personal server or in the cloud anyway, it was a workable solution. In my case it worked reasonably well, and if I went though the trouble of identifying or putting together a bootable Linux distro with a desktop I really liked I could probably live with something like that as a permanent solution. I'm not nearly as privacy conscious or paranoid as the author, so I'm satisfied with the convenience of a stateful laptop. I don't even have a screen lock when it wakes from sleep. If you want to use a stateless machine like the author describes, you're going to need a personal server or a cloud provider you really trust to keep your stuff. Edit: ge0rg had already posted link to non-PDF version.

spydum 11y ago
I'm not sure you read the paper? The concern centered on all the flash/firmware compnents such as SPI flash and wifi/BT firmware, not just the OS or hard drive. The idea proposed was to have SPI and all device firmware on a secure USB stick that you always keep with you..
- loudmax 11y ago
  You're right. I read the blog post, then skimmed the actual paper. You can already do what she proposes at the OS level, but her concerns go much deeper.
  - rolandr 11y ago
    It seems like a pretty valid concern. Part of the next generation of rootkits seems to be targeted at SMM-level rootkits (termed "ring -1" by some) that are installed in the BIOS. They are practically undetectable once installed, and can punch through hypervisor protections too. I think that is also part of the author's concern with Intel ME being present on all systems. It is a separate microcontroller in the chipset that has power on the level of "ring -3" (I believe it is used to implement much of the new SGE instruction set, for example).

by loudmax 11y ago

spydum 11y ago

I'm not sure you read the paper? The concern centered on all the flash/firmware compnents such as SPI flash and wifi/BT firmware, not just the OS or hard drive. The idea proposed was to have SPI and all device firmware on a secure USB stick that you always keep with you..

loudmax 11y ago
You're right. I read the blog post, then skimmed the actual paper. You can already do what she proposes at the OS level, but her concerns go much deeper.
- rolandr 11y ago
  It seems like a pretty valid concern. Part of the next generation of rootkits seems to be targeted at SMM-level rootkits (termed "ring -1" by some) that are installed in the BIOS. They are practically undetectable once installed, and can punch through hypervisor protections too. I think that is also part of the author's concern with Intel ME being present on all systems. It is a separate microcontroller in the chipset that has power on the level of "ring -3" (I believe it is used to implement much of the new SGE instruction set, for example).