3 ms·
It was the ME firmware that was compromised with this CSME exploit. Of course, few people notice if the ME firmware is updated, and Intel doesn't often update
by sounds 7y ago
It was the ME firmware that was compromised with this CSME exploit.
Of course, few people notice if the ME firmware is updated, and Intel doesn't often update deployed ME firmware. But it verifies the BIOS, and the BIOS verifies the kernel.
And that's the point where people start caring. Hence I used the kernel as an example.
Signal is thinking about using SGX, but they also have other ways to grant the user reasonable security. After this CSME exploit, Signal may reconsider using SGX.
Either way, my point still stands: verifiable builds do not rely on trusted computing at this point. I hope they never do. It would be twisted logic to tell the user the only way they can have their software freedom is by asking the trusted computing infrastructure to verify it for them. The trusted computing infrastructure being absolutely as opaque and locked-down as possible. Trusted computing is not reproducible! Its designed-in purpose is to be opaque, to hide things from the user.
- lxgr 7y ago> verifiable builds do not rely on trusted computing at this point. Of course they don't. They are orthogonal, i.e. one does not imply the other, but one also does not prevent the other. The verifiable build serves you, the hardware owner, in knowing that the software does what its vendor claims. The trusted platform's assertion serves the software vendor, allowing them to trust the environment that their software is running in. > It would be twisted logic to tell the user the only way they can have their software freedom is by asking the trusted computing infrastructure to verify it for them. Nobody is saying that. If you want to trust your computer to do what you think it does, you don't want trusted computing; you probably want reproducible builds, trusted boot etc. But trusted computing also does not inherently prevent you from doing that. The two are orthogonal!
- Reelin 7y ago> If you want to trust your computer to do what you think it does, you don't want trusted computing ... I suppose this depends on precisely what's meant by the term. Trusted computing based on a root of trust you control is incredibly useful by providing guarantees to you about remote systems you own and operate. This can be realized at present using Secure Boot and a TPM, but more hardware support (ex VM screening or SGX based on your own keys) would be nice. You seem to be using trusted computing to refer only to hardware that works against the owner. Instead, I've always thought of it as referring to a device that is capable of providing various guarantees about the code it executes - it just happens that current implementations are primarily designed to provide those guarantees to third parties instead of the owner.
- ryukafalz 7y ago> You seem to be using trusted computing to refer only to hardware that works against the owner. Instead, I've always thought of it as referring to a device that is capable of providing various guarantees about the code it executes - it just happens that current implementations are primarily designed to provide those guarantees to third parties instead of the owner. This is also my take on it. As with many issues in tech, it’s not about the tech itself, but rather who the tech is working for.