5 ms·

RISC-V sounds like a good idea, but (imo) could lead to a situation, where all/many device manufacturers make custom processors based of the liberally licensed

RISC-V sounds like a good idea, but (imo) could lead to a situation, where all/many device manufacturers make custom processors based of the liberally licensed code-base. At first, this sounds great, "Yah, no more reliance on Intel/ARM/, no more ME/Trustzone". But then you realize, that although you, the user/buyer, can build/run some custom code on there, you'll never be able to tell for sure, if you did not get a version/series with a gimped HWRND, or other (security-reducing) goodies. Targeted attacks will become very easy for anybody, who can pressure companies/engineers into adding something for (a subset of) the customers, or can reroute/intercept device shipments to you. ARM is a "known" situation. They have TrustZone, we know it exists, but buyers/end-users do not get full control of it (outside of some niche products, or dev-boards). That situation will not change. With ARM, get already got used to the idea, that you'll never "own" the machine, you are merely allowed to execute some code in a walled-off area of your Telescreen. So, with RISC-V, you have even less assurance, that the processor IC really contains what you expect, and nothing more.

young_unixer 6y ago
RISC-V allows companies to make closed systems, but it also allows them to make open systems, which wasn't viable before. Most people will keep using closed systems because they don't care about computer architecture, but us hackers will finally have a chance at having a (small) portion of the market. A small industry of open hardware.
- stragies 6y ago
  > RISC-V allows companies to make closed systems, but it also allows them to make open systems True, but can you recall any moment in history, where market forces did not actually make producing "open" devices unprofitable? So, (imo) in theory, you are right, but in practice, (successful) companies will use the technology to create "even more closed" system, and worse: Make systems, where the user can't even tell, if he got an "open" system. > A small industry of open hardware That you will only be able to use in a lab/isolated_env, or illegally, because mandatory signing of FWs/BLs/OSs/APPs is just around the corner for consumer devices capable of speaking to the internet.
  - tossaway69 6y ago
    mandatory for whom?
    - stragies 6y ago
      I don't know, where you live, but in most of the world, certification/signing/encryption of RF-capable Devices/Firmware has been established rule for decades, with a few exceptions for dev-boards. TPM, ME, SB, the_recent_grub_fixes,etc are all steps putting in place a pervasive infrastructure, that will enable truly draconian control over our computing devices for the key-holders. And I have not reason not to believe, that somebody somewhere is waiting for a pre-text to implement full vertical stack control in law for his (region/country/domain). Perhaps "so that we can ensure, that the contact-tracing app gets installed everywhere, otherwise we'll all die!!11!". Or protecting us from Terrorism; that usually does the trick. This argument also works surprisingly well to argue against backdoor-less encryption protocols. See e.g. Australia (iirc) Do you not perceive a similar evolution? Note, TP,SB,ME could in theory be used to build "secure" systems, but currently they are (also) used to secure the PC against you, the buyer/user.
  - hakfoo 6y ago
    > True, but can you recall any moment in history, where market forces did not actually make producing "open" devices unprofitable? I'd say that the early era of personal computers proved it. The Apple II and IBM PC were very open platforms-- thoroughly documented, developer friendly and made with very few parts you couldn't buy out of your favourite electronics distributor catalogue. They were riotous successes in large part because the open platform meant they didn't have to guess or corral the entire market. Remember that most of the killer apps of the era (VisiCalc, WordPerfect, dBase, 1-2-3, etc.) were third party, and it was largely aftermarket firms selling "six-in-one" cards, Sound Blasters, and Hercules graphics cards that patched the gaping holes in the PC's hardware design. Conversely, look at a machine like the TI-99/4 series: while on paper a decent machine for the time, it was as "closed" as a machine of the era could be: an unusually limited built-in development platform, and many of the desirable upgrades involved buying a very expensive expansion chassis. It's interesting to consider what the business tradeoffs of today's walled garden model are. Apple could choose to do a "pure hardware" play, or emulate the early 1980s IBM, where they offered some popular software via their own product line as a trusted source. The result would probably be a marginally larger total addressable market, as it would bring some customers and developers to the platform who needed something that could never clear the App Store before. But would the growth in market size compensate for the reduction in the average cut they can command from the market?
- klelatti 6y ago
  If your device isn't hackable then it's not because of ARM imposed limitations - it's because of decisions made by the device maufacturer and there is no reason why that would change if they were using RISC-V instead.
feanaro 6y ago
> But then you realize, that although you, the user/buyer, can build/run some custom code on there, you'll never be able to tell for sure, if you did not get a version/series with a gimped HWRND, or other (security-reducing) goodies. Targeted attacks will become very easy for anybody, who can pressure companies/engineers into adding something for (a subset of) the customers, or can reroute/intercept device shipments to you. I fail to see how this is different from today's situation. What's stopping targetted attacks via custom modifications of ARM or x86 chips?
- stragies 6y ago
  > What's stopping targeted attacks via custom modifications of ARM or x86 chips? Nothing, if you have power over the manufacturers. (Usually governments) But now, with RISC-V, anybody with deep enough pockets to spare a few million can create fake silicon, where you'd need an electron microscope to prove, that you got an "enhanced by TAO" chip.
  - armitron 6y ago
    > anybody with deep enough pockets to spare a few million Which for all intents is ... governments. So no real difference.
outsomnia 6y ago
This is completely backwards. See India's Shakti https://www.economist.com/asia/2019/10/03/india-is-trying-to-create-an-indigenous-chip-making-industry https://www.economist.com/asia/2019/10/03/india-is-trying-to... ... where they will fab their own cpu chips for, eg, military use starting from inspectable, verifiable open source Risc-V HDL.
- stragies 6y ago
  If you re-read my post, you'll see, that we are not contradicting each-other. If you have the time/money/infrastructure/knowledge/trusted_personnel to design/make/test/etc entire processors, then now with RISC-V you can in theory make secure systems. Also remember, that your effort needs to already start at the level of tool-chain, and other tooling, all the way down to the transistor. Otherwise you'll have a trust problem with regards to your compilers/synthesizers/etc. But that is quite a high barrier for entry for anybody smaller than a decent sized country.
  - outsomnia 6y ago
    > So, with RISC-V, you have even less assurance, that the processor IC really contains what you expect, and nothing more. What you wrote, quoted above, has it completely backwards.
    - stragies 6y ago
      If you haven't produced the processor, and the tooling, and the base components all by yourself?.
      - outsomnia 6y ago
        shrug someone is wrong on the internet... you have a choice to learn something, or keep trying to pretend to have been right... nobody cares...
        stragies 6y ago

young_unixer 6y ago

RISC-V allows companies to make closed systems, but it also allows them to make open systems, which wasn't viable before. Most people will keep using closed systems because they don't care about computer architecture, but us hackers will finally have a chance at having a (small) portion of the market. A small industry of open hardware.

stragies 6y ago
> RISC-V allows companies to make closed systems, but it also allows them to make open systems True, but can you recall any moment in history, where market forces did not actually make producing "open" devices unprofitable? So, (imo) in theory, you are right, but in practice, (successful) companies will use the technology to create "even more closed" system, and worse: Make systems, where the user can't even tell, if he got an "open" system. > A small industry of open hardware That you will only be able to use in a lab/isolated_env, or illegally, because mandatory signing of FWs/BLs/OSs/APPs is just around the corner for consumer devices capable of speaking to the internet.
- tossaway69 6y ago
  mandatory for whom?
  - stragies 6y ago
    I don't know, where you live, but in most of the world, certification/signing/encryption of RF-capable Devices/Firmware has been established rule for decades, with a few exceptions for dev-boards. TPM, ME, SB, the_recent_grub_fixes,etc are all steps putting in place a pervasive infrastructure, that will enable truly draconian control over our computing devices for the key-holders. And I have not reason not to believe, that somebody somewhere is waiting for a pre-text to implement full vertical stack control in law for his (region/country/domain). Perhaps "so that we can ensure, that the contact-tracing app gets installed everywhere, otherwise we'll all die!!11!". Or protecting us from Terrorism; that usually does the trick. This argument also works surprisingly well to argue against backdoor-less encryption protocols. See e.g. Australia (iirc) Do you not perceive a similar evolution? Note, TP,SB,ME could in theory be used to build "secure" systems, but currently they are (also) used to secure the PC against you, the buyer/user.
- hakfoo 6y ago
  > True, but can you recall any moment in history, where market forces did not actually make producing "open" devices unprofitable? I'd say that the early era of personal computers proved it. The Apple II and IBM PC were very open platforms-- thoroughly documented, developer friendly and made with very few parts you couldn't buy out of your favourite electronics distributor catalogue. They were riotous successes in large part because the open platform meant they didn't have to guess or corral the entire market. Remember that most of the killer apps of the era (VisiCalc, WordPerfect, dBase, 1-2-3, etc.) were third party, and it was largely aftermarket firms selling "six-in-one" cards, Sound Blasters, and Hercules graphics cards that patched the gaping holes in the PC's hardware design. Conversely, look at a machine like the TI-99/4 series: while on paper a decent machine for the time, it was as "closed" as a machine of the era could be: an unusually limited built-in development platform, and many of the desirable upgrades involved buying a very expensive expansion chassis. It's interesting to consider what the business tradeoffs of today's walled garden model are. Apple could choose to do a "pure hardware" play, or emulate the early 1980s IBM, where they offered some popular software via their own product line as a trusted source. The result would probably be a marginally larger total addressable market, as it would bring some customers and developers to the platform who needed something that could never clear the App Store before. But would the growth in market size compensate for the reduction in the average cut they can command from the market?
klelatti 6y ago
If your device isn't hackable then it's not because of ARM imposed limitations - it's because of decisions made by the device maufacturer and there is no reason why that would change if they were using RISC-V instead.

feanaro 6y ago

> But then you realize, that although you, the user/buyer, can build/run some custom code on there, you'll never be able to tell for sure, if you did not get a version/series with a gimped HWRND, or other (security-reducing) goodies. Targeted attacks will become very easy for anybody, who can pressure companies/engineers into adding something for (a subset of) the customers, or can reroute/intercept device shipments to you. I fail to see how this is different from today's situation. What's stopping targetted attacks via custom modifications of ARM or x86 chips?

stragies 6y ago
> What's stopping targeted attacks via custom modifications of ARM or x86 chips? Nothing, if you have power over the manufacturers. (Usually governments) But now, with RISC-V, anybody with deep enough pockets to spare a few million can create fake silicon, where you'd need an electron microscope to prove, that you got an "enhanced by TAO" chip.
- armitron 6y ago
  > anybody with deep enough pockets to spare a few million Which for all intents is ... governments. So no real difference.

outsomnia 6y ago

This is completely backwards. See India's Shakti https://www.economist.com/asia/2019/10/03/india-is-trying-to-create-an-indigenous-chip-making-industry https://www.economist.com/asia/2019/10/03/india-is-trying-to... ... where they will fab their own cpu chips for, eg, military use starting from inspectable, verifiable open source Risc-V HDL.

stragies 6y ago
If you re-read my post, you'll see, that we are not contradicting each-other. If you have the time/money/infrastructure/knowledge/trusted_personnel to design/make/test/etc entire processors, then now with RISC-V you can in theory make secure systems. Also remember, that your effort needs to already start at the level of tool-chain, and other tooling, all the way down to the transistor. Otherwise you'll have a trust problem with regards to your compilers/synthesizers/etc. But that is quite a high barrier for entry for anybody smaller than a decent sized country.
- outsomnia 6y ago
  > So, with RISC-V, you have even less assurance, that the processor IC really contains what you expect, and nothing more. What you wrote, quoted above, has it completely backwards.
  - stragies 6y ago
    If you haven't produced the processor, and the tooling, and the base components all by yourself?.
    - outsomnia 6y ago
      shrug someone is wrong on the internet... you have a choice to learn something, or keep trying to pretend to have been right... nobody cares...
      - stragies 6y ago