5 ms·

Talos™ II drives the state of the art of secure computing forward. Talos™ II gives you — and only you — full control of your machine's security. Rest assured kn

Talos™ II drives the state of the art of secure computing forward. Talos™ II gives you — and only you — full control of your machine's security. Rest assured knowing that only your authorized software and firmware are running via POWER9's secure boot features. Don't trust us? Look at the secure boot sources yourself — and modify them as you wish. That's the power of Talos™ II. That is fkin nice to be honest. There is so few which do this. totally already worth the price. (open source bios/boot procedures etc.). It's a total mess trying to get such a setup on a x86 server machine. i think there is a grand total of 1 server board which support coreboot (?)

samstave 9y ago
I just learned about laptops from a Bay Area company yesterday: purism HTTPS://puri.sm Coreboot based laptops...
- olympus 9y ago
  The main criticism against Purism laptops is that they still contain proprietary blobs (from Intel) in the coreboot payload. We have no way of knowing what's in those blobs. Purism tries to be free, and is a step up from other vendors, but doesn't go far enough for some people.
  - samstave 9y ago
    Thanks for the info... what's a better/the best option? Also, this is a laptop, so a diff class than server/desktop models - so may not be fair to even compare them ?
    - nextos 9y ago
      The very best option right now (and dirty cheap, ~$200 new) is to get an Asus C201P / Flip Chromebook. It uses a Rockchip ARM CPU, and if you disable 3D acceleration (which is slow anyway) and use an external wireless antenna, you don't have any closed firmware in your computer. Not even CPU microcode firmware. This is unique. Of course, it's a machine targeted by Libreboot: https://libreboot.org/docs/hardware/c201.html https://libreboot.org/docs/hardware/c201.html I guess that if you install GuixSD, given all binary packages can be verified against the source, and there are some decent sandboxing facilities you can get pretty great security.
      - rekado 9y ago
        At the moment GuixSD doesn't yet work on ARM. Not much is missing and you can use Guix as a package manager on top of some other variant of the GNU system, but GuixSD on ARM is not quite ready yet. Give it a couple more weeks.
    - olympus 9y ago
      Don't take my comment to mean that Purism is evil, just that you aren't getting some ironclad security guarantee. This explains the "controversy" better than I can (http://www.pcworld.com/article/2960524/laptop-computers/why-linux-enthusiasts-are-arguing-over-purisms-sleek-idealistic-librem-laptops.html http://www.pcworld.com/article/2960524/laptop-computers/why-...). Purism is certainly a step up from Lenovo that was shipping computers with rootkits installed. If you wear a tinfoil hat then you're going to be better off with a libreboot laptop, but you have to accept that you will never use a computer made after 2008. I think that the niche that a Purism laptop fills isn't worth the price premium. A laptop from a main vendor plus a security conscious OS install (full disk encryption, two factor authentication) is fine for me.
      - samstave 9y ago
        So just to be 100% clear, and for the edification of everyone (myself included); It is literally safe to assume that every single device is 100% compromised and the 5eyes, can if they wish, monitor every single thing you do, based on these issues, correct? But then, you also have to think that every service that you use, outside of your own 100% controlled purview (I.e. Literally any cloud service) is also summarily compromised to the point that you cannot say that one is completely secure... Would this be safe to say?
        olympus 9y ago
        That's a rather strong way of putting it, but yes, you should assume that every device you use can be penetrated by a sufficiently advanced and motivated actor. You should also be comfortable with the fact that state level actors have been recording information so that they can reach into your past should you ever become a problem with them. In that mindset, you have to create a security environment such that the truly advanced actors aren't motivated enough to bother with you. At the same time, don't leave your front door wide open so that any teenager can walk in and steal your TV. I'm personally not worried about the 5eyes (but anti-gov activists should be). I'm worried about the smart kid who can use metasploit to take the banking info off my laptop in the middle of the night without me knowing it. A Purism laptop doesn't protect me from the smart teenager any more than an HP does. Full disk encryption and a Yubikey probably does, along with a decent firewall. Using cloud services where I encrypt my data before uploading is better than one where I transmit unencrypted (or where the cloud service controls the key). A company willing to drop several thousand dollars on a Talos II might be worried about corporate espionage, so they might be willing to pay for a verifiable bios. The NSA has to worry about thousands of hackers from dozens of countries around the world, so they are willing to pay for custom silicon. Of course, you also need to consider physical security, which is like this: https://xkcd.com/538/ https://xkcd.com/538/
    - rekado 9y ago
      You can buy somewhat older hardware with Libreboot from various outlets including Minifree.org, tehnoetic.com, Zerocat.de, and Vikings.net. They all offer x86 hardware that works without blobs and without ME. (Of course they don't solve the problem of firmware on disk controllers or network chips, but there is no such project yet.)
  - milcron 9y ago
    They are a lot better since investing in the me_cleaner project. Not all of the management engine can be removed, but it can be neutered (most of the binary deleted, including the network stack). I used to think Purism was a sham, but now that the ME can be neutered I find it an acceptable compromise.
- fao_ 9y ago
  See also: https://minifree.org/ https://minifree.org/ Their laptops have been gutted of the Intel Management Engine/AMD PSP, they ship with coreboot on them, and (I think) they're without binary blobs(?).
  - rekado 9y ago
    Yes, they are without blobs. They come with Libreboot, a coreboot distribution without blobs, not vanilla coreboot. Similar notebooks with Libreboot are offered by vikings.net, tehnoetic.com, and zerocat.de; minifree.org is the business of Libreboot's main developer and former lead, so buying from them directly supports development of Libreboot.
torpcoms 9y ago
https://www.coreboot.org/Supported_Motherboards https://www.coreboot.org/Supported_Motherboards Looks like 2 [+ 2 for old builds] server boards supported; which is ironic since coreboot began as a project for server clusters.

samstave 9y ago

I just learned about laptops from a Bay Area company yesterday: purism HTTPS://puri.sm Coreboot based laptops...

olympus 9y ago
The main criticism against Purism laptops is that they still contain proprietary blobs (from Intel) in the coreboot payload. We have no way of knowing what's in those blobs. Purism tries to be free, and is a step up from other vendors, but doesn't go far enough for some people.
- samstave 9y ago
  Thanks for the info... what's a better/the best option? Also, this is a laptop, so a diff class than server/desktop models - so may not be fair to even compare them ?
  - nextos 9y ago
    The very best option right now (and dirty cheap, ~$200 new) is to get an Asus C201P / Flip Chromebook. It uses a Rockchip ARM CPU, and if you disable 3D acceleration (which is slow anyway) and use an external wireless antenna, you don't have any closed firmware in your computer. Not even CPU microcode firmware. This is unique. Of course, it's a machine targeted by Libreboot: https://libreboot.org/docs/hardware/c201.html https://libreboot.org/docs/hardware/c201.html I guess that if you install GuixSD, given all binary packages can be verified against the source, and there are some decent sandboxing facilities you can get pretty great security.
    - rekado 9y ago
      At the moment GuixSD doesn't yet work on ARM. Not much is missing and you can use Guix as a package manager on top of some other variant of the GNU system, but GuixSD on ARM is not quite ready yet. Give it a couple more weeks.
  - olympus 9y ago
    Don't take my comment to mean that Purism is evil, just that you aren't getting some ironclad security guarantee. This explains the "controversy" better than I can (http://www.pcworld.com/article/2960524/laptop-computers/why-linux-enthusiasts-are-arguing-over-purisms-sleek-idealistic-librem-laptops.html http://www.pcworld.com/article/2960524/laptop-computers/why-...). Purism is certainly a step up from Lenovo that was shipping computers with rootkits installed. If you wear a tinfoil hat then you're going to be better off with a libreboot laptop, but you have to accept that you will never use a computer made after 2008. I think that the niche that a Purism laptop fills isn't worth the price premium. A laptop from a main vendor plus a security conscious OS install (full disk encryption, two factor authentication) is fine for me.
    - samstave 9y ago
      So just to be 100% clear, and for the edification of everyone (myself included); It is literally safe to assume that every single device is 100% compromised and the 5eyes, can if they wish, monitor every single thing you do, based on these issues, correct? But then, you also have to think that every service that you use, outside of your own 100% controlled purview (I.e. Literally any cloud service) is also summarily compromised to the point that you cannot say that one is completely secure... Would this be safe to say?
      - olympus 9y ago
        That's a rather strong way of putting it, but yes, you should assume that every device you use can be penetrated by a sufficiently advanced and motivated actor. You should also be comfortable with the fact that state level actors have been recording information so that they can reach into your past should you ever become a problem with them. In that mindset, you have to create a security environment such that the truly advanced actors aren't motivated enough to bother with you. At the same time, don't leave your front door wide open so that any teenager can walk in and steal your TV. I'm personally not worried about the 5eyes (but anti-gov activists should be). I'm worried about the smart kid who can use metasploit to take the banking info off my laptop in the middle of the night without me knowing it. A Purism laptop doesn't protect me from the smart teenager any more than an HP does. Full disk encryption and a Yubikey probably does, along with a decent firewall. Using cloud services where I encrypt my data before uploading is better than one where I transmit unencrypted (or where the cloud service controls the key). A company willing to drop several thousand dollars on a Talos II might be worried about corporate espionage, so they might be willing to pay for a verifiable bios. The NSA has to worry about thousands of hackers from dozens of countries around the world, so they are willing to pay for custom silicon. Of course, you also need to consider physical security, which is like this: https://xkcd.com/538/ https://xkcd.com/538/
  - rekado 9y ago
    You can buy somewhat older hardware with Libreboot from various outlets including Minifree.org, tehnoetic.com, Zerocat.de, and Vikings.net. They all offer x86 hardware that works without blobs and without ME. (Of course they don't solve the problem of firmware on disk controllers or network chips, but there is no such project yet.)
- milcron 9y ago
  They are a lot better since investing in the me_cleaner project. Not all of the management engine can be removed, but it can be neutered (most of the binary deleted, including the network stack). I used to think Purism was a sham, but now that the ME can be neutered I find it an acceptable compromise.
fao_ 9y ago
See also: https://minifree.org/ https://minifree.org/ Their laptops have been gutted of the Intel Management Engine/AMD PSP, they ship with coreboot on them, and (I think) they're without binary blobs(?).
- rekado 9y ago
  Yes, they are without blobs. They come with Libreboot, a coreboot distribution without blobs, not vanilla coreboot. Similar notebooks with Libreboot are offered by vikings.net, tehnoetic.com, and zerocat.de; minifree.org is the business of Libreboot's main developer and former lead, so buying from them directly supports development of Libreboot.

torpcoms 9y ago

https://www.coreboot.org/Supported_Motherboards https://www.coreboot.org/Supported_Motherboards Looks like 2 [+ 2 for old builds] server boards supported; which is ironic since coreboot began as a project for server clusters.