15 ms·

AMD to consider coreboot/Libreboot support for Ryzen

267 points by preya2k 10y ago

Zekio 10y ago
AMD would probably win over a lot of people if they officially support it
- jplayer01 10y ago
  You mean the dozen people who care? I guess so.
  - jychang 10y ago
    The actual percent of users who use it may be small, but they're the most vocal and activist group who recommend products to the majority of ignorant people. Coreboot is a good thing, and if AMD could implement it, they should do so.
    - green7ea 10y ago
      I think there is also a huge benifit for OEMs: it would reduce the cost of developping a Ryzen system. If you're Asus and you want to make a Ryzen motherboard, you have to write or license a BIOS. If Ryzen supports coreboot, this is something you no longer have to do and the system is much closer to working out of the box. The downside for OEMs is that a lot of them use the BIOS as a way to differentiate themselves with extra features. I think there is going to be some initial resistance because of this but it shouldn't be too major.
      - wolfgke 10y ago
        > I think there is also a huge benifit for OEMs: it would reduce the cost of developping a Ryzen system. There is also a huge potential disbenefit for OEMs: It can make it more difficult to "stand out" from competition by offering a firmware (UEFI, BIOS) that has vendor-specific "advantages": OEMs do of course like implementing such mainboard-vendor-specific modifications; I also heard there seem to be in particular gamers who love such implementations that offer more "graphical bling" in the UEFI firmware. Since when open firmware becomes a desired property of mainboards, OEM will have to be better in terms of concrete features of the hardware instead of graphical tricks to stand out from competition (which is hard work), I can also imagine quite well that OEMs are cautious about such open firmware desires.
        AnthonyMouse 10y ago
        > It can make it more difficult to "stand out" from competition by offering a firmware (UEFI, BIOS) that has vendor-specific "advantages" Not really. Look at what Samsung does to Android. Let the upstream maintainers do 99.7% of the real work, then change five random things for no reason other than to be able to claim your competitors don't have that.
        JoeAltmaier 10y ago
        It is a long and prosperous tradition. Just look at all the versions of unix out there.
    - DannyBee 10y ago
      "The actual percent of users who use it may be small, but they're the most vocal and activist group who recommend products to the majority of ignorant people. " Citation needed?
      - ctrl-j 10y ago
        You need a citation to know that GNU proponents are heavily evangelical? The bastards are worse than Mormons.
        Spivak 10y ago
        Or that when people buy computers they reach out to their 'techie friend' for recommendations.
        cwyers 10y ago
        GNU proponents are heavily evangelical. But, if you look at what software and hardware gets used, they don't seem to be very influential. People seem to ask their Windows-using friends and relatives for recommendations, not their closest GNU evangelist.
        DannyBee 10y ago
        "You need a citation to know that GNU proponents are heavily evangelical? " ;_) No, i need a citation that anyone actually cares what they say.
  - tscs37 10y ago
    While I agree with you, not a lot of people, I still think it would be better if people had the option.
  - rasz_pl 10y ago
    Yes. The real trick is this dozen is usually very influential and should be counted as a force multiplier. This is how Macs became THE multimedia machines 15 years ago(final cut pro).
  - akerro 10y ago
    Dozen of people and dozens of startups and big companies that would be created if CPUs and Mobos were more open.
  - agumonkey 10y ago
    as said on reddit, the fact that it was second or third highest comment hints otherwise.
  - kriro 10y ago
    They could aggressively go after certain corporate/government clients (and obviously also consumers but I'd guess not many really care...sadly) with a "no Management Engine, no secrets, no back doors, just secure" pitch. Not saying it's the right play but there's a strategy.
  - Qantourisc 10y ago
    Don't forget that some companies might wish to run core boot in their stack, to for example allow remote debugging of many servers. (Without costly third party hard/firmware.)
- DeepYogurt 10y ago
  +1, this would completely sell me on amd products.
  - madez 10y ago
    Me too. I don't need more performance right now so I have no plan to buy a new system, but if AMD received coreboot support without blobs, I would buy new hardware right away.
  - jakeogh 10y ago
    Competition! I'll happily pencil AMD into my next buy if this happens. It's been a long time... there's a 2xK9 around here somewhere.
- mtgx 10y ago
  Also, if they support Coreboot, they'll probably get some AMD chips in some Chromebooks as well.
anoother 10y ago
This refers to a reply in the AMA that reads: "Thanks for the inquiry. Currently we do not have plans to release source code but you make a good argument for reasons to do so. We will evaluate and find a way to work with security vendors and the community to everyone's benefit." To consider this 'consideration' seems rather.... hopeful.
- shmerl 10y ago
  They surely should do it. It would give them an advantage over Intel.
- kilburn 10y ago
  Later on she says: > I will bring this to the attention of the product team for serious consideration, so please feel like you have been heard even if we were not able to give you an easy 'yes' right away. Which is not a commitment of course, but goes the extra mile to make it clear that it's not your standard PR reply either. Let's hope!
  - throwaway7767 10y ago
    Still sounds like a standard customer service response to me, just from a good CSR. "Please feel like you have been heard"? I think that captures it. I'd love it if this happened, it would make me change my purchasing habits to prefer AMD over Intel. But I'll believe it when I see it, and I can't say this post on their forums changes my assessment of the probabilities at all.
    - irq-1 10y ago
      The CEO and other management were in the same thread answering questions... but not that question. The reply is just polite PR unfortunately.
    - snovv_crash 10y ago
      It isn't on their forums, it is a Reddit AMA.
  - 10y ago
Hates_ 10y ago
For the layman, what does this mean/offer?
- dima_medvedev 10y ago
  Currently most modern hardware we own contains a backdoor at the BIOS level. It's a black-box blob of code that does all the initialization and can potentially call home (Intel/AMD) and do almost everything on your system. Another thing is that we can't debug and fix BIOS-related problems (like software suspend). More here https://libreboot.org/faq/#intelme https://libreboot.org/faq/#intelme
- throwaway77384 10y ago
  Intel has been sorta/kinda comprimising every single computer containing their chipsets for quite some time now. The Intel Management Engine will make a lot of tinfoil hats tingle: http://hackaday.com/2016/11/28/neutralizing-intels-management-engine/ http://hackaday.com/2016/11/28/neutralizing-intels-managemen... Libre-boot and coreboot promote a kind of transparency where you know what your system is booting and why. It's much better than having this proprietary walled garden with astounding amounts of power/control inaccessible to anyone but Intel in your machine. Intel would of course argue that this is necessary for good crypto and it's for the users, not against them. Which may hold true a little bit....until it's compromised by someone.
- bantunes 10y ago
  Open source "BIOS" and insanely fast (some times <1 sec) time to GRUB menu from power on. More info https://en.wikipedia.org/wiki/Coreboot https://en.wikipedia.org/wiki/Coreboot
- aibrahem 10y ago
  A couple of years ago both Intel and AMD started developing their own solutions that allows them to offload some the functionality that used to happen on the main processor to another co-processor placed inside the chipset on the motherboard, functionalities like power management, secure booting, USB handling..etc The problem is not only that this co-processor is running it's own operating system with full unrestricted access to the systems main memory and network interface, but also that the main processor can't actually tell what the co-processor is doing with this data or when does it access it, on top of that both Intel and AMD delivers you the software running on the co-processor as a binary blob so we can't really be sure if it's secure, has backdoors, spying on you, etc.. LibreBoot/Coreboot are projects to write an open-source BIOS for x86 hardware, and since a big part of the BIOS is running on this co-processor you only have a choice of either using the binary blob provided by Intel/AMD or lose the functionality provided.
godmodus 10y ago
If AMD does this I'm theirs for life!
drdaeman 10y ago
What could be arguments for not doing so? Not a rhetorical question - I'm genuinely curious. What's the point of keeping BIOS blobs in secrecy? If it's some secret sauce know-hows - what sort of information could be possibly revealed, that a skilled competitor-hired reverse engineer can't obtain? I understand that it's hard to talk about actual secrets, but are there any similar-enough examples from the past? I know many hardware companies are highly secretive-by-default, but is that a real thing, this secrecy protects, or just some business superstitions?
- floatboth 10y ago
  BIOS blobs aren't the problem, coreboot actually replaces them. The problem is early initialization firmware on the CPU/chipset/etc. And the fact that parts of initialization are moved into Management Engine / Platform Security Processor which are tiny processors running a third party proprietary OS (Trustonic TEE OS in the case of AMD). Of course there's no real thing to protect, these companies just don't give a fuck.
  - i336_ 10y ago
    > Trustonic TEE OS I have visions of the Windows 95 3D screensaver, with the walls, floor and ceiling displaying the many, many NDAs you need to sign to get access to this. (I must admit that what initially came to mind was ~2:25 in http://youtu.be/EUXnJraKM3k http://youtu.be/EUXnJraKM3k (2:55).) In all seriousness, this may be the tricky bit. AMD may need to release the PSP spec and get Libreboot to take it from there. Considering the huge amount of support for this though, I can totally see a crowdfunded firmware implementation for the PSP working out.
moppl 10y ago
This is a futile discussion. It would not make any difference if AMD released the PSP source code. The problem with the PSP is not it's firmware, it is a much deeper fundamental architectural problem as outlined in (unfortunately dead link) https://www.reddit.com/r/linux/comments/5x5xl3/amd_to_consider_corebootlibreboot_support_contact/degd6wi/ https://www.reddit.com/r/linux/comments/5x5xl3/amd_to_consid... If AMD would release the source code, the PSP would still remain a black box controlled by the manufacturer. It is an autonomous universal computer (with it's own CPU, RAM, ROM, clock...) which can load/run anytime any software AMD wants it to. There is no way for the user to tell what software it is running at the moment and what it is doing on the platform. It has fully privileged access to the users resources while it offers no interface for the user (only a very minimal low level interface). So the fundamental problem is, that it takes the control of the platform away from the user, the manufacturer is ultimately in control on the platform. This is what goes against the philosophy of Coreboot/Libreboot (of being completely in control of the platform), not simply the encrypted PSP firmware blob. Knowing that blob would not compromise the PSP and would not give the control back to the user.
- i336_ 10y ago
  Unfortunately the link you just provided just died. If you're on Linux, your best bet is likely to be attaching to each renderer process and running `generate-core-file`. Unfortunately (and very annoyingly) chrome://cache stores HTTPS-encrypted data, which you would need to have previously exported SSLKEYLOGFILE to decrypt. Alternatively, if you still have the tab open, CTRL+S :D Regarding your point though, if the PSP is _completely laid open_ so we can understand how it works, can't we load our own firmware into the PSP and then be confident that that's what's running?
  - moppl 10y ago
    Oh, sorry for the dead link. So I repost it here: "Hello!? Releasing the source code would NOT change the fundamental problem with the PSP! It will still remain a black box under the control of the manufacturer! The problem is not the obfuscation of the source code, it is a much deeper platform architecture issue. The PSP is a universal computer with it's own CPU, RAM, ROM, clock etc, that can run whatever software AMD wants it to run, hidden from the user. It could load software anytime without you even noticing. AMD controls the PSP by using unique cryptographic keys which are burnt into each PSP. As the Intel IME engineer Xiaoyu Ruan wrote in his book "Platform Embedded Security Technology Revealed", the security architecture of the IME does not rely on security through obscurity, it relies much more on the burnt in cryptographic keys and it's architecture. The designers of the IME took into account that the firmware might be unscrambled and realeased by somebody, so they designed it in a way that this would not compromise it. Even if you have it's source code (it's OS so to speak), there is no way for the user to tell what software it has loaded into memory and what it is doing at the moment (since it is a universal computer in its own right which offers no interface to the user). It is a parallel world on the platform the user has no access to (while the PSP has fully privileged access to all the users resources). So the only real way to support Coreboot/Libreboot would be to remove the PSP completely (which is probably not possible, since it became an integral part of the system) or to offer the option to disable it and/or feed it with one's own cryptographic keys. IMHO it stays an uncontrollable risk as long as there is an PSP on the platform (likewise the IME on Intel platforms). The source code doesn't make a difference. The only advantage of releasing the source would be, that it could be checked for potential security risks to avoid hostile takeovers of the PSP (which would be a true disaster). So don't be naive, don't believe this hype." To further answer your question (as far as I am able to do that), if the PSP is _completely laid open, it would not change its fundamental design, and it would not allow you to put your own firmware. It would be necessary to know its burnt in and unique cryptographic keys, to be able to load your own firmware/software. I would say those cryptographic keys are the crown jewels of the PSP (or IME), which allow you to take control of the PSP. And those are (hopefully) only known to the manufacturer and will not be released with the source code ;) The problem is cast in silicon so to speak.
i336_ 10y ago
* PSA for anyone interested in ME security * Would like to drop this tidbit I found recently. The following is completely unverifiable and not going to convince some people but I found it interesting. From the AMA linked in the link: > 1) Security Through Obscurity doesn't work. As mention by /u/Gusec At some point in time, (somebody or some organization) will break this. When I read that I remembered this: https://www.reddit.com/r/onions/comments/5i6qa3/can_the_nsafbi_use_intel_me_to_defeat_tor_on_95/dbkxlw2/?context=10000 https://www.reddit.com/r/onions/comments/5i6qa3/can_the_nsaf... Mirror: http://archive.is/T8yVz http://archive.is/T8yVz My focus is on the first paragraph in the wall of text, the bit about the signing keys floating around out there. This is, again, totally unverifiable, and could for all I know be a skiddie strutting (it does read a bit like that). I thought it was an interesting bit of insight though, for what it's worth; and maybe some people could use it as a lead. Regarding the views offered in that post, I am myself quite wary, simply because I don't know this person's providence and I have no idea if this is whatever you call the opposite of a scare campaign. (If it is it's a bit weird, so it probably isn't.) (I will note that it looks like the person in question doesn't seem to want to be contactable, so poking them is unlikely to be helpful. I also wonder why they used a new Reddit account for each post.) I found it when reading https://www.crowdsupply.com/raptor-computing-systems/talos-secure-workstation/updates/the-state-of-owner-controlled-computing-as-talos-winds-down https://www.crowdsupply.com/raptor-computing-systems/talos-s... (mirror: http://archive.is/znkp3 http://archive.is/znkp3)
ajross 10y ago
Uh... what they said was: "Thanks for the inquiry. Currently we do not have plans to release source code but you make a good argument for reasons to do so. We will evaluate and find a way to work with security vendors and the community to everyone's benefit." That's as clear a corporate "no" as you're going to find, folks. There's no story here. There will be no PSP source release.
- madez 10y ago
  While corporatese is not one of my key strengths, I think they've commited now to something that can't be dealt with with a simple "No, you won't get source code."
mrstone 10y ago
I'm dumb and don't really understand why this is beneficial. I also don't have a lot of in-depth knowledge about CPUs, would someone mind explaining what the problem is and how AMD doing this solves it?
- ysleepy 10y ago
  There is a secret OS running inside the CPU that you don't have access to. Only Intel/AMD know whats really inside and it has access to everything in your system. Usually it even interjects itself into the LAN controller listening and sending network traffic. This is all for some definition of security, but since you the user do not have access to, or control over it is most certainly not for your security.

267 points by preya2k 10y ago

Zekio 10y ago

AMD would probably win over a lot of people if they officially support it

jplayer01 10y ago
You mean the dozen people who care? I guess so.
- jychang 10y ago
  The actual percent of users who use it may be small, but they're the most vocal and activist group who recommend products to the majority of ignorant people. Coreboot is a good thing, and if AMD could implement it, they should do so.
  - green7ea 10y ago
    I think there is also a huge benifit for OEMs: it would reduce the cost of developping a Ryzen system. If you're Asus and you want to make a Ryzen motherboard, you have to write or license a BIOS. If Ryzen supports coreboot, this is something you no longer have to do and the system is much closer to working out of the box. The downside for OEMs is that a lot of them use the BIOS as a way to differentiate themselves with extra features. I think there is going to be some initial resistance because of this but it shouldn't be too major.
    - wolfgke 10y ago
      > I think there is also a huge benifit for OEMs: it would reduce the cost of developping a Ryzen system. There is also a huge potential disbenefit for OEMs: It can make it more difficult to "stand out" from competition by offering a firmware (UEFI, BIOS) that has vendor-specific "advantages": OEMs do of course like implementing such mainboard-vendor-specific modifications; I also heard there seem to be in particular gamers who love such implementations that offer more "graphical bling" in the UEFI firmware. Since when open firmware becomes a desired property of mainboards, OEM will have to be better in terms of concrete features of the hardware instead of graphical tricks to stand out from competition (which is hard work), I can also imagine quite well that OEMs are cautious about such open firmware desires.
      - AnthonyMouse 10y ago
        > It can make it more difficult to "stand out" from competition by offering a firmware (UEFI, BIOS) that has vendor-specific "advantages" Not really. Look at what Samsung does to Android. Let the upstream maintainers do 99.7% of the real work, then change five random things for no reason other than to be able to claim your competitors don't have that.
        JoeAltmaier 10y ago
        It is a long and prosperous tradition. Just look at all the versions of unix out there.
  - DannyBee 10y ago
    "The actual percent of users who use it may be small, but they're the most vocal and activist group who recommend products to the majority of ignorant people. " Citation needed?
    - ctrl-j 10y ago
      You need a citation to know that GNU proponents are heavily evangelical? The bastards are worse than Mormons.
      - Spivak 10y ago
        Or that when people buy computers they reach out to their 'techie friend' for recommendations.
      - cwyers 10y ago
        GNU proponents are heavily evangelical. But, if you look at what software and hardware gets used, they don't seem to be very influential. People seem to ask their Windows-using friends and relatives for recommendations, not their closest GNU evangelist.
      - DannyBee 10y ago
        "You need a citation to know that GNU proponents are heavily evangelical? " ;_) No, i need a citation that anyone actually cares what they say.
- tscs37 10y ago
  While I agree with you, not a lot of people, I still think it would be better if people had the option.
- rasz_pl 10y ago
  Yes. The real trick is this dozen is usually very influential and should be counted as a force multiplier. This is how Macs became THE multimedia machines 15 years ago(final cut pro).
- akerro 10y ago
  Dozen of people and dozens of startups and big companies that would be created if CPUs and Mobos were more open.
- agumonkey 10y ago
  as said on reddit, the fact that it was second or third highest comment hints otherwise.
- kriro 10y ago
  They could aggressively go after certain corporate/government clients (and obviously also consumers but I'd guess not many really care...sadly) with a "no Management Engine, no secrets, no back doors, just secure" pitch. Not saying it's the right play but there's a strategy.
- Qantourisc 10y ago
  Don't forget that some companies might wish to run core boot in their stack, to for example allow remote debugging of many servers. (Without costly third party hard/firmware.)
DeepYogurt 10y ago
+1, this would completely sell me on amd products.
- madez 10y ago
  Me too. I don't need more performance right now so I have no plan to buy a new system, but if AMD received coreboot support without blobs, I would buy new hardware right away.
- jakeogh 10y ago
  Competition! I'll happily pencil AMD into my next buy if this happens. It's been a long time... there's a 2xK9 around here somewhere.
mtgx 10y ago
Also, if they support Coreboot, they'll probably get some AMD chips in some Chromebooks as well.

anoother 10y ago

This refers to a reply in the AMA that reads: "Thanks for the inquiry. Currently we do not have plans to release source code but you make a good argument for reasons to do so. We will evaluate and find a way to work with security vendors and the community to everyone's benefit." To consider this 'consideration' seems rather.... hopeful.

shmerl 10y ago
They surely should do it. It would give them an advantage over Intel.
kilburn 10y ago
Later on she says: > I will bring this to the attention of the product team for serious consideration, so please feel like you have been heard even if we were not able to give you an easy 'yes' right away. Which is not a commitment of course, but goes the extra mile to make it clear that it's not your standard PR reply either. Let's hope!
- throwaway7767 10y ago
  Still sounds like a standard customer service response to me, just from a good CSR. "Please feel like you have been heard"? I think that captures it. I'd love it if this happened, it would make me change my purchasing habits to prefer AMD over Intel. But I'll believe it when I see it, and I can't say this post on their forums changes my assessment of the probabilities at all.
  - irq-1 10y ago
    The CEO and other management were in the same thread answering questions... but not that question. The reply is just polite PR unfortunately.
  - snovv_crash 10y ago
    It isn't on their forums, it is a Reddit AMA.
- 10y ago

Hates_ 10y ago

For the layman, what does this mean/offer?

dima_medvedev 10y ago
Currently most modern hardware we own contains a backdoor at the BIOS level. It's a black-box blob of code that does all the initialization and can potentially call home (Intel/AMD) and do almost everything on your system. Another thing is that we can't debug and fix BIOS-related problems (like software suspend). More here https://libreboot.org/faq/#intelme https://libreboot.org/faq/#intelme
throwaway77384 10y ago
Intel has been sorta/kinda comprimising every single computer containing their chipsets for quite some time now. The Intel Management Engine will make a lot of tinfoil hats tingle: http://hackaday.com/2016/11/28/neutralizing-intels-management-engine/ http://hackaday.com/2016/11/28/neutralizing-intels-managemen... Libre-boot and coreboot promote a kind of transparency where you know what your system is booting and why. It's much better than having this proprietary walled garden with astounding amounts of power/control inaccessible to anyone but Intel in your machine. Intel would of course argue that this is necessary for good crypto and it's for the users, not against them. Which may hold true a little bit....until it's compromised by someone.
bantunes 10y ago
Open source "BIOS" and insanely fast (some times <1 sec) time to GRUB menu from power on. More info https://en.wikipedia.org/wiki/Coreboot https://en.wikipedia.org/wiki/Coreboot
aibrahem 10y ago
A couple of years ago both Intel and AMD started developing their own solutions that allows them to offload some the functionality that used to happen on the main processor to another co-processor placed inside the chipset on the motherboard, functionalities like power management, secure booting, USB handling..etc The problem is not only that this co-processor is running it's own operating system with full unrestricted access to the systems main memory and network interface, but also that the main processor can't actually tell what the co-processor is doing with this data or when does it access it, on top of that both Intel and AMD delivers you the software running on the co-processor as a binary blob so we can't really be sure if it's secure, has backdoors, spying on you, etc.. LibreBoot/Coreboot are projects to write an open-source BIOS for x86 hardware, and since a big part of the BIOS is running on this co-processor you only have a choice of either using the binary blob provided by Intel/AMD or lose the functionality provided.

godmodus 10y ago

If AMD does this I'm theirs for life!

drdaeman 10y ago

What could be arguments for not doing so? Not a rhetorical question - I'm genuinely curious. What's the point of keeping BIOS blobs in secrecy? If it's some secret sauce know-hows - what sort of information could be possibly revealed, that a skilled competitor-hired reverse engineer can't obtain? I understand that it's hard to talk about actual secrets, but are there any similar-enough examples from the past? I know many hardware companies are highly secretive-by-default, but is that a real thing, this secrecy protects, or just some business superstitions?

floatboth 10y ago
BIOS blobs aren't the problem, coreboot actually replaces them. The problem is early initialization firmware on the CPU/chipset/etc. And the fact that parts of initialization are moved into Management Engine / Platform Security Processor which are tiny processors running a third party proprietary OS (Trustonic TEE OS in the case of AMD). Of course there's no real thing to protect, these companies just don't give a fuck.
- i336_ 10y ago
  > Trustonic TEE OS I have visions of the Windows 95 3D screensaver, with the walls, floor and ceiling displaying the many, many NDAs you need to sign to get access to this. (I must admit that what initially came to mind was ~2:25 in http://youtu.be/EUXnJraKM3k http://youtu.be/EUXnJraKM3k (2:55).) In all seriousness, this may be the tricky bit. AMD may need to release the PSP spec and get Libreboot to take it from there. Considering the huge amount of support for this though, I can totally see a crowdfunded firmware implementation for the PSP working out.

moppl 10y ago

This is a futile discussion. It would not make any difference if AMD released the PSP source code. The problem with the PSP is not it's firmware, it is a much deeper fundamental architectural problem as outlined in (unfortunately dead link) https://www.reddit.com/r/linux/comments/5x5xl3/amd_to_consider_corebootlibreboot_support_contact/degd6wi/ https://www.reddit.com/r/linux/comments/5x5xl3/amd_to_consid... If AMD would release the source code, the PSP would still remain a black box controlled by the manufacturer. It is an autonomous universal computer (with it's own CPU, RAM, ROM, clock...) which can load/run anytime any software AMD wants it to. There is no way for the user to tell what software it is running at the moment and what it is doing on the platform. It has fully privileged access to the users resources while it offers no interface for the user (only a very minimal low level interface). So the fundamental problem is, that it takes the control of the platform away from the user, the manufacturer is ultimately in control on the platform. This is what goes against the philosophy of Coreboot/Libreboot (of being completely in control of the platform), not simply the encrypted PSP firmware blob. Knowing that blob would not compromise the PSP and would not give the control back to the user.

i336_ 10y ago
Unfortunately the link you just provided just died. If you're on Linux, your best bet is likely to be attaching to each renderer process and running `generate-core-file`. Unfortunately (and very annoyingly) chrome://cache stores HTTPS-encrypted data, which you would need to have previously exported SSLKEYLOGFILE to decrypt. Alternatively, if you still have the tab open, CTRL+S :D Regarding your point though, if the PSP is _completely laid open_ so we can understand how it works, can't we load our own firmware into the PSP and then be confident that that's what's running?
- moppl 10y ago
  Oh, sorry for the dead link. So I repost it here: "Hello!? Releasing the source code would NOT change the fundamental problem with the PSP! It will still remain a black box under the control of the manufacturer! The problem is not the obfuscation of the source code, it is a much deeper platform architecture issue. The PSP is a universal computer with it's own CPU, RAM, ROM, clock etc, that can run whatever software AMD wants it to run, hidden from the user. It could load software anytime without you even noticing. AMD controls the PSP by using unique cryptographic keys which are burnt into each PSP. As the Intel IME engineer Xiaoyu Ruan wrote in his book "Platform Embedded Security Technology Revealed", the security architecture of the IME does not rely on security through obscurity, it relies much more on the burnt in cryptographic keys and it's architecture. The designers of the IME took into account that the firmware might be unscrambled and realeased by somebody, so they designed it in a way that this would not compromise it. Even if you have it's source code (it's OS so to speak), there is no way for the user to tell what software it has loaded into memory and what it is doing at the moment (since it is a universal computer in its own right which offers no interface to the user). It is a parallel world on the platform the user has no access to (while the PSP has fully privileged access to all the users resources). So the only real way to support Coreboot/Libreboot would be to remove the PSP completely (which is probably not possible, since it became an integral part of the system) or to offer the option to disable it and/or feed it with one's own cryptographic keys. IMHO it stays an uncontrollable risk as long as there is an PSP on the platform (likewise the IME on Intel platforms). The source code doesn't make a difference. The only advantage of releasing the source would be, that it could be checked for potential security risks to avoid hostile takeovers of the PSP (which would be a true disaster). So don't be naive, don't believe this hype." To further answer your question (as far as I am able to do that), if the PSP is _completely laid open, it would not change its fundamental design, and it would not allow you to put your own firmware. It would be necessary to know its burnt in and unique cryptographic keys, to be able to load your own firmware/software. I would say those cryptographic keys are the crown jewels of the PSP (or IME), which allow you to take control of the PSP. And those are (hopefully) only known to the manufacturer and will not be released with the source code ;) The problem is cast in silicon so to speak.

i336_ 10y ago

* PSA for anyone interested in ME security * Would like to drop this tidbit I found recently. The following is completely unverifiable and not going to convince some people but I found it interesting. From the AMA linked in the link: > 1) Security Through Obscurity doesn't work. As mention by /u/Gusec At some point in time, (somebody or some organization) will break this. When I read that I remembered this: https://www.reddit.com/r/onions/comments/5i6qa3/can_the_nsafbi_use_intel_me_to_defeat_tor_on_95/dbkxlw2/?context=10000 https://www.reddit.com/r/onions/comments/5i6qa3/can_the_nsaf... Mirror: http://archive.is/T8yVz http://archive.is/T8yVz My focus is on the first paragraph in the wall of text, the bit about the signing keys floating around out there. This is, again, totally unverifiable, and could for all I know be a skiddie strutting (it does read a bit like that). I thought it was an interesting bit of insight though, for what it's worth; and maybe some people could use it as a lead. Regarding the views offered in that post, I am myself quite wary, simply because I don't know this person's providence and I have no idea if this is whatever you call the opposite of a scare campaign. (If it is it's a bit weird, so it probably isn't.) (I will note that it looks like the person in question doesn't seem to want to be contactable, so poking them is unlikely to be helpful. I also wonder why they used a new Reddit account for each post.) I found it when reading https://www.crowdsupply.com/raptor-computing-systems/talos-secure-workstation/updates/the-state-of-owner-controlled-computing-as-talos-winds-down https://www.crowdsupply.com/raptor-computing-systems/talos-s... (mirror: http://archive.is/znkp3 http://archive.is/znkp3)

ajross 10y ago

Uh... what they said was: "Thanks for the inquiry. Currently we do not have plans to release source code but you make a good argument for reasons to do so. We will evaluate and find a way to work with security vendors and the community to everyone's benefit." That's as clear a corporate "no" as you're going to find, folks. There's no story here. There will be no PSP source release.

madez 10y ago
While corporatese is not one of my key strengths, I think they've commited now to something that can't be dealt with with a simple "No, you won't get source code."

mrstone 10y ago

I'm dumb and don't really understand why this is beneficial. I also don't have a lot of in-depth knowledge about CPUs, would someone mind explaining what the problem is and how AMD doing this solves it?

ysleepy 10y ago
There is a secret OS running inside the CPU that you don't have access to. Only Intel/AMD know whats really inside and it has access to everything in your system. Usually it even interjects itself into the LAN controller listening and sending network traffic. This is all for some definition of security, but since you the user do not have access to, or control over it is most certainly not for your security.