4 ms·

If I was a government these are the exact sorts of projects I'd set up as a honey pot to tempt people who are doing illegal things to use my pre compromised har

If I was a government these are the exact sorts of projects I'd set up as a honey pot to tempt people who are doing illegal things to use my pre compromised hardware. How can I trust NitroPad more than another laptop manufacturer? I actually trust this much less.

ericmay 7y ago
Potentially, and I saw this comment after clicking the link and my first thought was that this company/laptop looks too generic. Something feels off. Could be wrong. But also don’t care since I’m not in the market for it.
- arianvanp 7y ago
  That's because they do not produce the laptops. As it says on the website they're modified Lenovo X230 thinkpads. A super common laptop in the enterprise world
  - ericmay 7y ago
    Sure - that’s why I said company/laptop. I should have been more specific, I guess. But pretty much everything about the writing, branding, marketing, and company seem too generic for me.
bubblethink 7y ago
If you try to read the article, including the linked projects, it helps a lot rather than broadcasting every nascent thought that pops up in the head to the internet. All the ingredients have been a long time in the making. To summarise, it builds upon coreboot, heads, nitrokey, and me_cleaner, all of which are open source and have been developed by various people in this domain who also know what they are doing. It uses a thinkpad x230 as it is an ivy bridge processor, the last generation of intel processors whose initialisation is open source and well understood. If you would like to read more about this specific combination, you can also read at https://www.qubes-os.org/doc/certified-hardware/#qubes-certified-laptop-insurgo-privacybeast-x230 https://www.qubes-os.org/doc/certified-hardware/#qubes-certi... .
- andy_ppp 7y ago
  >> it helps a lot rather than broadcasting every nascent thought that pops up in the head to the internet I think you mean "broadcasting every nascent thought that pops up into your head to the internet". I did read the article! I'm sorry that you feel hurt by me not trusting your hardware company but it's a problem that you will have to overcome if you are going to sell this more secure hardware to people. Maybe not insulting people who have valid concerns about your product might also be a good place to start. Anyway, good luck with it, I hope you find a business here that is useful.
  - bubblethink 7y ago
    It's not my hardware company. No affiliation with them. I am not hurt; just annoyed because you proclaimed, "I trust this much less". This is precisely the goal of these projects. i.e., To reduce the trusted computing base. And the company is a fairly small part of the puzzle here. A lot of man hours have gone in building and reverse engineering various parts of the stack. Your statement is roughly similar to "I trust this much less" if it had been made sometime in the 90s on the linux announcement thread.
  - deleted 7y ago
    [deleted]
- danShumway 7y ago
  I also read the article, and did look at the linked projects, and it's not clear to me how they solve GP's issue, because the company is still providing these solutions precompiled on hardware they control. How does GP know that everything is actually being provided unmodified, without any backdoors? > it helps a lot rather than broadcasting every nascent thought that pops up in the head to the internet. I don't think this is helpful, it's unnecessarily antagonistic and dismissive. GP's point seems reasonable to me; I don't see anything here that means that the Thinkpad x230 couldn't be modified before installation/paring, or that the tools themselves couldn't be modified before the laptop was shipped. If there is a reason to trust the initial build process, the linked page isn't explaining what it is.

ericmay 7y ago

Potentially, and I saw this comment after clicking the link and my first thought was that this company/laptop looks too generic. Something feels off. Could be wrong. But also don’t care since I’m not in the market for it.

arianvanp 7y ago
That's because they do not produce the laptops. As it says on the website they're modified Lenovo X230 thinkpads. A super common laptop in the enterprise world
- ericmay 7y ago
  Sure - that’s why I said company/laptop. I should have been more specific, I guess. But pretty much everything about the writing, branding, marketing, and company seem too generic for me.

bubblethink 7y ago

If you try to read the article, including the linked projects, it helps a lot rather than broadcasting every nascent thought that pops up in the head to the internet. All the ingredients have been a long time in the making. To summarise, it builds upon coreboot, heads, nitrokey, and me_cleaner, all of which are open source and have been developed by various people in this domain who also know what they are doing. It uses a thinkpad x230 as it is an ivy bridge processor, the last generation of intel processors whose initialisation is open source and well understood. If you would like to read more about this specific combination, you can also read at https://www.qubes-os.org/doc/certified-hardware/#qubes-certified-laptop-insurgo-privacybeast-x230 https://www.qubes-os.org/doc/certified-hardware/#qubes-certi... .

andy_ppp 7y ago
>> it helps a lot rather than broadcasting every nascent thought that pops up in the head to the internet I think you mean "broadcasting every nascent thought that pops up into your head to the internet". I did read the article! I'm sorry that you feel hurt by me not trusting your hardware company but it's a problem that you will have to overcome if you are going to sell this more secure hardware to people. Maybe not insulting people who have valid concerns about your product might also be a good place to start. Anyway, good luck with it, I hope you find a business here that is useful.
- bubblethink 7y ago
  It's not my hardware company. No affiliation with them. I am not hurt; just annoyed because you proclaimed, "I trust this much less". This is precisely the goal of these projects. i.e., To reduce the trusted computing base. And the company is a fairly small part of the puzzle here. A lot of man hours have gone in building and reverse engineering various parts of the stack. Your statement is roughly similar to "I trust this much less" if it had been made sometime in the 90s on the linux announcement thread.
- deleted 7y ago
  [deleted]
danShumway 7y ago
I also read the article, and did look at the linked projects, and it's not clear to me how they solve GP's issue, because the company is still providing these solutions precompiled on hardware they control. How does GP know that everything is actually being provided unmodified, without any backdoors? > it helps a lot rather than broadcasting every nascent thought that pops up in the head to the internet. I don't think this is helpful, it's unnecessarily antagonistic and dismissive. GP's point seems reasonable to me; I don't see anything here that means that the Thinkpad x230 couldn't be modified before installation/paring, or that the tools themselves couldn't be modified before the laptop was shipped. If there is a reason to trust the initial build process, the linked page isn't explaining what it is.