3 ms·

That's putting a lot of faith in HW manufacturers' security practices. I've had conversations with ex-employees of a couple of large cell phone firms who know a

by kabdib 8y ago

That's putting a lot of faith in HW manufacturers' security practices. I've had conversations with ex-employees of a couple of large cell phone firms who know about their build systems, and am not willing to buy those brands now. (Think: Dedicated PCs, one builder for each major revision of a phone, basically unpatched for years, with magic and difficult to reproduce configurations. Don't know specifically about HSMs, but those seem unlikely given their level of care and sophistication).

luma 8y ago
That's a pretty accurate description of firmware build environments for a whole lot of products, not just cell phones.
- kabdib 8y ago
  Once upon a time, a certain large maker of a popular video game console lost the hardware engineer's laptop where the source code for the game controller firmware was. I don't know the nature of the catastrophe, whether the code was accidentally deleted, or the drive failed, or perhaps the employee left and the the laptop got recycled. In any event, the source was gone. Source control? What's that? Sounds complicated and unnecessary. All you need are files on disk, right? "Wait, I thought your laptop had the source code. Um..." They wound up paying a consultant to disassemble the binary and turn it back into plausible C. For all I know, given the way that those firmware engineers wrote code, the recreated source was of better quality than the original. :-/ [I am trying real hard not to turn this into a "how bad can firmware code get" comment, but I do have to say that this was the same group where one contractor had written the firmware for a device, consisting of one massive function with a bunch of goto statements and static variables, with names like 'v' and 'x' and 'xx'. The contractor also seemed to think that removing whitespace from the program would make the binary run faster...]

by kabdib 8y ago

luma 8y ago

That's a pretty accurate description of firmware build environments for a whole lot of products, not just cell phones.

kabdib 8y ago
Once upon a time, a certain large maker of a popular video game console lost the hardware engineer's laptop where the source code for the game controller firmware was. I don't know the nature of the catastrophe, whether the code was accidentally deleted, or the drive failed, or perhaps the employee left and the the laptop got recycled. In any event, the source was gone. Source control? What's that? Sounds complicated and unnecessary. All you need are files on disk, right? "Wait, I thought your laptop had the source code. Um..." They wound up paying a consultant to disassemble the binary and turn it back into plausible C. For all I know, given the way that those firmware engineers wrote code, the recreated source was of better quality than the original. :-/ [I am trying real hard not to turn this into a "how bad can firmware code get" comment, but I do have to say that this was the same group where one contractor had written the firmware for a device, consisting of one massive function with a bunch of goto statements and static variables, with names like 'v' and 'x' and 'xx'. The contractor also seemed to think that removing whitespace from the program would make the binary run faster...]