6 ms·

How does "running fully free software" helps alleviate "compromised x86"?

by SlavikCA 6y ago

waihtis 6y ago
Wrap up that fully free software with LibreBoot and you're good to go!
- marcosdumay 6y ago
  Wrap with LibreBoot, replace all the non-free firmware, check your hardware on a microscope against embedded backdoors, oh, and don't forget to verify your stack's source and your building environment. But, well, you can stop at your CPU's manufacturer website, where you will find ME/PSP, well documented as a backdoor. It will save you the trouble of verifying the hardware and firmware.
panny 6y ago
If you're running fully free software, you're not running x86, since it can't boot without backdoored binary blobs.
- Thorrez 6y ago
  What about Libreboot? Doesn't that allow booting x86 without binary blobs?
  - panny 6y ago
    Yes, very old hardware that's no longer on the market. I don't consider that a solution. Eventually that pool of hardware dries up.
    - drewbug 6y ago
      https://libreboot.org/suppliers.html https://libreboot.org/suppliers.html
    - daffy 6y ago
      It's easy to find x200 etc. used. Flashing is another story.
      - fsflover 6y ago
        > Flashing is another story. https://tehnoetic.com/tet-lis https://tehnoetic.com/tet-lis
  - numpad0 6y ago
    They still need some parts of blobs to configure/initialize the system and that “some” now means full MINIX kernel along its userland
    - daffy 6y ago
      Are you saying a librebooted machine is still probably backdoored?
      - dannyw 6y ago
        Precisely.
    - fsflover 6y ago
      You are talking about Coreboot, not Libreboot. The latter has no blobs whatsoever.
      - daffy 6y ago
        Does that mean that a firmware backdoor is impossible or very unlikely?
        fsflover 6y ago
        Yes, it should be harder.
    - boring_twenties 6y ago
      That's not correct, Libreboot does not work on those systems that require any part of the ME to boot. You might be thinking of me_cleaner[1], which removes most but not all of the ME blobs. This is unrelated to Libreboot though, it works on newer systems and is not needed when using Libreboot because the latter gets rid of the (very early versions of) the ME completely. [1] https://github.com/corna/me_cleaner https://github.com/corna/me_cleaner
- novaRom 6y ago
  All modern ARMs have ROM block containing undocumented booting sequence.
  - panny 6y ago
    You're wrong, but with such confidence! Here is a documented ARM booting sequence with fully free firmware, https://stikonas.eu/wordpress/2019/09/15/blobless-boot-with-rockpro64/ https://stikonas.eu/wordpress/2019/09/15/blobless-boot-with-...
    - monocasa 6y ago
      That 32k BootROM isn't free in your example. SoCs will also have "pre-boot" code that runs before that: > However, even one of their most ardent open-source advocates pushed back quite hard when I suggested they should share their pre-boot code. By pre-boot code, I’m not talking about the little ROM blob that gets run after reset to set up your peripherals so you can pull your bootloader from SD card or SSD. That part was a no-brainer to share. I’m talking about the code that gets run before the architecturally guaranteed “reset vector”. A number of software developers (and alarmingly, some security experts) believe that the life of a CPU begins at the reset vector. In fact, there’s often a significant body of code that gets executed on a CPU to set things up to meet the architectural guarantees of a hard reset – bringing all the registers to their reset state, tuning clock generators, gating peripherals, and so forth. Critically, chip makers heavily rely upon this pre-boot code to also patch all kinds of embarrassing silicon bugs, and to enforce binning rules. https://www.bunniestudios.com/blog/?p=5127 https://www.bunniestudios.com/blog/?p=5127
      - panny 6y ago
        >That 32k BootROM isn't free in your example. It's a ROM. Read only. https://www.fsf.org/news/freebios.html https://www.fsf.org/news/freebios.html "The BIOS was impossible to replace because it was stored in ROM: the only way to to put in a different BIOS was by replacing part of the hardware. In effect, the BIOS was itself hardware--and therefore didn't really count as software. It was like the program that (we can suppose) exists in the computer that (we can suppose) runs your watch or your microwave oven: since you can't install software on it, it may as well be circuits, not a computer at all." Edit: >ROMs can still be backdoored, which is the point of this discussion. You said it wasn't free, and when proven wrong, you moved the goalpost. Since I'm a wrongthinker who can only post once every hour or two on this site, I'm done discussing this with you. If you want to try to convince people that a 32K ROM is the same as IntelME, then you're not worth my time anyway.

How does "running fully free software" helps alleviate "compromised x86"?

waihtis 6y ago

Wrap up that fully free software with LibreBoot and you're good to go!

marcosdumay 6y ago
Wrap with LibreBoot, replace all the non-free firmware, check your hardware on a microscope against embedded backdoors, oh, and don't forget to verify your stack's source and your building environment. But, well, you can stop at your CPU's manufacturer website, where you will find ME/PSP, well documented as a backdoor. It will save you the trouble of verifying the hardware and firmware.

panny 6y ago

If you're running fully free software, you're not running x86, since it can't boot without backdoored binary blobs.

Thorrez 6y ago
What about Libreboot? Doesn't that allow booting x86 without binary blobs?
- panny 6y ago
  Yes, very old hardware that's no longer on the market. I don't consider that a solution. Eventually that pool of hardware dries up.
  - drewbug 6y ago
    https://libreboot.org/suppliers.html https://libreboot.org/suppliers.html
  - daffy 6y ago
    It's easy to find x200 etc. used. Flashing is another story.
    - fsflover 6y ago
      > Flashing is another story. https://tehnoetic.com/tet-lis https://tehnoetic.com/tet-lis
- numpad0 6y ago
  They still need some parts of blobs to configure/initialize the system and that “some” now means full MINIX kernel along its userland
  - daffy 6y ago
    Are you saying a librebooted machine is still probably backdoored?
    - dannyw 6y ago
      Precisely.
  - fsflover 6y ago
    You are talking about Coreboot, not Libreboot. The latter has no blobs whatsoever.
    - daffy 6y ago
      Does that mean that a firmware backdoor is impossible or very unlikely?
      - fsflover 6y ago
        Yes, it should be harder.
  - boring_twenties 6y ago
    That's not correct, Libreboot does not work on those systems that require any part of the ME to boot. You might be thinking of me_cleaner[1], which removes most but not all of the ME blobs. This is unrelated to Libreboot though, it works on newer systems and is not needed when using Libreboot because the latter gets rid of the (very early versions of) the ME completely. [1] https://github.com/corna/me_cleaner https://github.com/corna/me_cleaner
novaRom 6y ago
All modern ARMs have ROM block containing undocumented booting sequence.
- panny 6y ago
  You're wrong, but with such confidence! Here is a documented ARM booting sequence with fully free firmware, https://stikonas.eu/wordpress/2019/09/15/blobless-boot-with-rockpro64/ https://stikonas.eu/wordpress/2019/09/15/blobless-boot-with-...
  - monocasa 6y ago
    That 32k BootROM isn't free in your example. SoCs will also have "pre-boot" code that runs before that: > However, even one of their most ardent open-source advocates pushed back quite hard when I suggested they should share their pre-boot code. By pre-boot code, I’m not talking about the little ROM blob that gets run after reset to set up your peripherals so you can pull your bootloader from SD card or SSD. That part was a no-brainer to share. I’m talking about the code that gets run before the architecturally guaranteed “reset vector”. A number of software developers (and alarmingly, some security experts) believe that the life of a CPU begins at the reset vector. In fact, there’s often a significant body of code that gets executed on a CPU to set things up to meet the architectural guarantees of a hard reset – bringing all the registers to their reset state, tuning clock generators, gating peripherals, and so forth. Critically, chip makers heavily rely upon this pre-boot code to also patch all kinds of embarrassing silicon bugs, and to enforce binning rules. https://www.bunniestudios.com/blog/?p=5127 https://www.bunniestudios.com/blog/?p=5127
    - panny 6y ago
      >That 32k BootROM isn't free in your example. It's a ROM. Read only. https://www.fsf.org/news/freebios.html https://www.fsf.org/news/freebios.html "The BIOS was impossible to replace because it was stored in ROM: the only way to to put in a different BIOS was by replacing part of the hardware. In effect, the BIOS was itself hardware--and therefore didn't really count as software. It was like the program that (we can suppose) exists in the computer that (we can suppose) runs your watch or your microwave oven: since you can't install software on it, it may as well be circuits, not a computer at all." Edit: >ROMs can still be backdoored, which is the point of this discussion. You said it wasn't free, and when proven wrong, you moved the goalpost. Since I'm a wrongthinker who can only post once every hour or two on this site, I'm done discussing this with you. If you want to try to convince people that a 32K ROM is the same as IntelME, then you're not worth my time anyway.