5 ms·

The integrity of the Linux source code still matters whether or not you trust your hardware vendor. Linux runs on more platforms than those two as well.

carapace 7y ago
Okay, relatively moot. Apologies for the snark, but I feel it's important to keep in mind in discussions of trust and security the enclosing scope or context. You can't trust the "integrity of the Linux source code" if you are checking it with compromised hardware, or running it on compromised hardware. > Linux runs on more platforms than those two as well. I am not a security specialist, just a plain ol' paranoiac, but at this point in history, given what we've seen and heard so far, I would bet most platforms are compromised hardware. I don't really have anything more constructive to add so I'll shut up now.
- GhettoMaestro 7y ago
  > Apologies for the snark, but I feel it's important to keep in mind in discussions of trust and security the enclosing scope or context. You can't trust the "integrity of the Linux source code" if you are checking it with compromised hardware, or running it on compromised hardware. You are incorrect in this instance. The topic at hand is ensuring software integrity. Your scope of analysis is what I'll call "full-stack integrity" (hardware, firmware, software, etc).
  - carapace 7y ago
    I'm pointing out that ensuring software integrity is a kind of toy or game in a world where the hardware is already "powned" by someone else. People aren't computing cryptographic checksums over the linux kernel by hand. The phrase "security theatre" is probably overused, but from my POV it would seem to apply here.
    - GhettoMaestro 7y ago
      Point it out all you want -- it is irrelevant to the discussion at hand. If said discussion was asserting integrity at a hardware level, you would have a point. But it doesn't do that. There is a reason it is narrowly prescriptive.

carapace 7y ago

Okay, relatively moot. Apologies for the snark, but I feel it's important to keep in mind in discussions of trust and security the enclosing scope or context. You can't trust the "integrity of the Linux source code" if you are checking it with compromised hardware, or running it on compromised hardware. > Linux runs on more platforms than those two as well. I am not a security specialist, just a plain ol' paranoiac, but at this point in history, given what we've seen and heard so far, I would bet most platforms are compromised hardware. I don't really have anything more constructive to add so I'll shut up now.

GhettoMaestro 7y ago
> Apologies for the snark, but I feel it's important to keep in mind in discussions of trust and security the enclosing scope or context. You can't trust the "integrity of the Linux source code" if you are checking it with compromised hardware, or running it on compromised hardware. You are incorrect in this instance. The topic at hand is ensuring software integrity. Your scope of analysis is what I'll call "full-stack integrity" (hardware, firmware, software, etc).
- carapace 7y ago
  I'm pointing out that ensuring software integrity is a kind of toy or game in a world where the hardware is already "powned" by someone else. People aren't computing cryptographic checksums over the linux kernel by hand. The phrase "security theatre" is probably overused, but from my POV it would seem to apply here.
  - GhettoMaestro 7y ago
    Point it out all you want -- it is irrelevant to the discussion at hand. If said discussion was asserting integrity at a hardware level, you would have a point. But it doesn't do that. There is a reason it is narrowly prescriptive.