5 ms·

Even if Intel gave you the source code, you still wouldn't know if there was any unauthorised code running.

• Taek 10y ago
  Reproducible builds is a very important part of knowing you are secure, and in the absence of that at least being able to flash on your own compilation.
  • hdhzy 10y ago
    Well even with reproducible builds how do you check what actually is running there? That'd be the ME reporting "I'm running version X" without a way to really verify it. Also if you flashed it you cannot be 100% sure there is no other component that is still running a rootkit.
    • schoen 10y ago
      Good analysis of this issue in Halvar Flake's https://www.slideshare.net/hashdays/why-johnny-cant-tell-if-he-is-compromised https://www.slideshare.net/hashdays/why-johnny-cant-tell-if-... ("Why Johnny can't tell if he is compromised").
      • ams6110 10y ago
        Or Ken Thompsons's Reflections on Trusting Trust.
• deleted 10y ago
  [deleted]