3 ms·

I guess my point is that as long as the hardware itself is closed source you have to trust the vendor anyway. Suppose the PSP source code was open sourced, how

by simias 9y ago

I guess my point is that as long as the hardware itself is closed source you have to trust the vendor anyway. Suppose the PSP source code was open sourced, how can you be sure it's actually what's being run by the CPU? How can you know certain instructions aren't backdoored somehow? It makes it a bit more difficult to implement such backdoors of course, but it's still perfectly doable. Again, I'm happy that people value their privacy and campaign for more open source but it seems a bit myopic to put all our attention on this tiny part of the problem. The risk is that if tomorrow AMD decides to actually open source the PSP many people will think that we won and the battle is over when we've just removed one of thousands of possible attack vectors.

zanny 9y ago
Analysts working on the Intel ME can test if its active by testing line voltages around he mainboard. Someone did manage to hard disable it, and it could be proven in how voltages dropped at various points on the motherboard. If all else fails it is still a physical piece of hardware.
- simias 9y ago
  That's good, but then shouldn't we petition to have a way to physically disable these modules instead of begging for a source code that won't get us anywhere closer to a trusted computing environment? It's a lot easier to validate that something is not running than it is to validate that it's running correctly.
  - zanny 9y ago
    Disabling the ME / PSP usually breaks booting. It would require stripped down open source PSP / ME firmware anyway to bypass it during boot.
admax88q 9y ago
> as long as the hardware itself is closed source you have to trust the vendor anyway Because it's an ongoing effort. Years ago people were running GNU software on proprietary kernels/operating systems. You can't get to fully free and open hardware in one step. Firmware is the next battlefield, and its an area that hardware manufacturers have been winning. The firmware on a modern machine is orders of magnitude larger than it was 10 years ago, while provided essentially the same features. More and more closed source code is running on your machine. If we don't push back sooner or later your linux install will only be running in a virtualized environment provided by the proprietary OS running in "firmware"
Karliss 9y ago
Intentional hardware backdoors are hopefully small and made by somewhat competent people. Hardware vendors already can't be trusted with writing code that does something useful there is no need to have any additional attack surface in code that provides almost no valuable functionality.

by simias 9y ago

zanny 9y ago

Analysts working on the Intel ME can test if its active by testing line voltages around he mainboard. Someone did manage to hard disable it, and it could be proven in how voltages dropped at various points on the motherboard. If all else fails it is still a physical piece of hardware.

simias 9y ago
That's good, but then shouldn't we petition to have a way to physically disable these modules instead of begging for a source code that won't get us anywhere closer to a trusted computing environment? It's a lot easier to validate that something is not running than it is to validate that it's running correctly.
- zanny 9y ago
  Disabling the ME / PSP usually breaks booting. It would require stripped down open source PSP / ME firmware anyway to bypass it during boot.

admax88q 9y ago

> as long as the hardware itself is closed source you have to trust the vendor anyway Because it's an ongoing effort. Years ago people were running GNU software on proprietary kernels/operating systems. You can't get to fully free and open hardware in one step. Firmware is the next battlefield, and its an area that hardware manufacturers have been winning. The firmware on a modern machine is orders of magnitude larger than it was 10 years ago, while provided essentially the same features. More and more closed source code is running on your machine. If we don't push back sooner or later your linux install will only be running in a virtualized environment provided by the proprietary OS running in "firmware"

Karliss 9y ago

Intentional hardware backdoors are hopefully small and made by somewhat competent people. Hardware vendors already can't be trusted with writing code that does something useful there is no need to have any additional attack surface in code that provides almost no valuable functionality.