5 ms·
This argument doesn't work when PCs are essentially the only widely available hardware platform that ended up with an open standard for modifying the software r
by ohazi 6y ago
This argument doesn't work when PCs are essentially the only widely available hardware platform that ended up with an open standard for modifying the software running on the device. Even here, the fact that we ended up with this model was an accident.
Every device or platform since the IBM PC, including phones, tablets, non-x86 PCs, thermostats, wristwatches, routers, appliances, cars, etc. -- all of them have switched to the device-only-accepts-firmware-signed-by-the-manufacturer model where you can't put your own software on the vast majority of devices without a significant amount of reverse engineering and hardware/firmware exploit hunting.
Software can't eat the world if nobody wants to make hardware that can run arbitrary software. Then it's only "this one particular company's software can eat your thermostat for the two years that they feel like providing device support, then it's trash."
I think that hardware (or at least boot architecture) does matter. For all of UEFI's flaws, the secure boot model is actually pretty good. A device can come with a preloaded manufacturer key, and can be configured by default to only run manufacturer signed firmware. But once a user buys the device, they have the option of adding an additional key, either from another third party (i.e. like the key that RedHat and Ubuntu use to sign their kernels), or keys that you or your organization generate and manage yourselves. You can also remove the preloaded key, because as the owner of the device, you should be able to do whatever you want with it. If the manufacturer needs their application to only work if the secure boot settings haven't been altered (i.e. in a car, with safety/liability concerns), they can do that.
I would be a lot happier if we had a model like this for literally any other non-PC platform. Right now everybody rolls their own crappy implementation of signature checking with hard-coded manufacturer keys. It's really pretty awful.
- tytso 6y agoThat simply is not true. Chromebooks, many Android phones (all of the ones sold by Google) have a way of turning off the requirement for signed boot. The device is less secure if you disable signed boot; an evil maid who gains access to your device, or the FBI after they seize your device, will have a much easier time getting access to your data --- but if you want to build your own version of Chromium, or put your own Linux distro on a chromebook, or if you want to build your own version of Android from source, and put it on a Nexus or Pixel phone, you can do this easily. (Well, the hard part is learning how to download all of the source code and learning how to use the Android build system, and then downloading a new system image onto the Android device; there is no technical restriction which prevents you from doing this.) I developed the ext4 encryption specifically for Chrome and Android, and I was building my own Android images and putting it on putting it on a Nexus 9 device. This didn't require any kind of special privilege or encryption keys only available to Google employees. Neither did this: https://thunk.org/android-xfstests https://thunk.org/android-xfstests It's all open source, and you can certainly rebuild your kernel, make other changes to the firmware, and install it on your phone. No reverse engineering or hardware/firmware exploits necessary!
- ohazi 6y agoYou're right. For all of Google's other flaws, their hardware has been surprisingly good about this. The Chromebook write-protect screw is a good example of a thoughtful feature here. However, Google's approach is so uncommon, that it's basically the exception that proves the rule. The vast majority of device manufacturers don't do anything like this, and if you were to pick a phone at random, you would probably expect to encounter some sort of issue flashing it. That's why we're still stuck with databases of "if you want to run a custom Android ROM on your phone / OpenWRT on your router / etc., pick from one of these known-good devices."
- Wowfunhappy 6y agoThere are a lot of other devices (that aren't x86 PCs) which let you boot OSs wholly from third parties. A couple that come to mind are Canon Cameras[1], and the Remarkable Tablet[2]. A lot of routers, too, don't put up any barriers the installation of alternate firmware (some do), and even Apple Silicon Macs can be made to boot unsigned OSs (and are getting a Linux port). Not to mention the Raspberry Pi and its ilk. I say this almost preemptively, because I really don't think it should obscure your core point: open devices are increasingly the exception, not the norm. 1: https://chdk.fandom.com/wiki/CHDK https://chdk.fandom.com/wiki/CHDK 2: https://hackaday.com/2020/09/06/a-free-software-os-for-the-remarkable-e-paper-tablet/ https://hackaday.com/2020/09/06/a-free-software-os-for-the-r...
- jra_samba 6y agoTed, you have to remember why Chromebooks have a way of turning off signed boot. It's actually to comply with GPLv3 requirements for the GPLv3 code used in ChromeOS. Google takes licensing seriously (as both know you and I know :-). No idea why we do the same for Android phones though. No GPLv3 in there :-).
- kmeisthax 6y agoGoogle could have stripped GPLv3 code out of ChromeOS like they did with Android. The reason why they provide owner overrides is entirely a matter of corporate culture.