4 ms·
I asked David Jordan, the engineer working on the firmware updater. >Not only aren't updates initiated without permission, I wrote the code to make that litera
by cassidyjames 9y ago
I asked David Jordan, the engineer working on the firmware updater.
>Not only aren't updates initiated without permission, I wrote the code to make that literally impossible without changes to the installed python code.
The code is available at https://github.com/pop-os/system76-driver https://github.com/pop-os/system76-driver and https://github.com/system76/firmware-update https://github.com/system76/firmware-update
- mulmen 9y agoThanks for the reply! So you can push an update to the python code that allows you to push an update to the firmware without prompting? Sounds like we still rely on the security of your systems to prevent malicious firmware from being pushed.
- yjftsjthsd-h 9y agoWell... yeah? They're the OS vendor; there is literally no way for them to do their job without having the ability to update the system.
- mulmen 9y agoYes they have to be able to update the system but in this case they are also able to update the firmware without asking which means anyone who can impersonate or coerce them can also update the firmware.
- ibotty 9y agoIf you control the OS, you also control the firmware (if you want a way to install new firmware from the OS). No way around.
- jdiez17 9y agoSince the firmware updater is a Python program, you can audit the source code by looking at the relevant directory in site-packages before you accept. If you're really paranoid you can set up a periodic script that sends you an email if the contents of that directory change.