7 ms·

Trustworthy Computing in 2021

112 points by hasheddan 5y ago

ilaksh 5y ago
Weird to me that more people are not working on Redox OS in this context.
- guerrilla 5y ago
  Why would that be necessary? They can if they want, I'm excited about Redox too, but Linux and the GNU ecosystem is already free software.
blueflow 5y ago
Is the author the same person that talks about Inclusivity, and then posts screencaps of other people they are having disagreements with to twitter, for their followers to sneer at? [1] Is this the same person who uses the departure of a developer as a reason to "fix" a community [2], when the mailmap of one of their projects shows they are referring to their own faked departure? [3] This stuff doesn't make the Alpine Linux project look good. I totally see that its very rude to attack a person like this, but i think its abusive behavior and needs to be called out. [1] https://twitter.com/ariadneconill/status/1445586541040979971 https://twitter.com/ariadneconill/status/1445586541040979971 [2] https://ariadne.space/2021/08/08/on-the-topic-of-community-management-cocs-etc/ https://ariadne.space/2021/08/08/on-the-topic-of-community-m... [3] https://github.com/pkgconf/pkgconf/commit/c7c3ddbfcf67a1b46d16f661c2a16b07b8a6b709 https://github.com/pkgconf/pkgconf/commit/c7c3ddbfcf67a1b46d...
guerrilla 5y ago
It's great to see that more people are still working on this and that people have an interest. If you are interested in this kind of thing, then you'll also want to check out LibreBoot[1] and Bootstrappable Builds[2]. The latter is working with stage0 [3] and mes [4] to bootstrap Guix (among other projects.) All of that is further down the chain, but we'll need it if we want to build trustworthy systems. 1. https://libreboot.org/ https://libreboot.org/ 2. https://www.bootstrappable.org https://www.bootstrappable.org 3. https://github.com/oriansj/stage0/ https://github.com/oriansj/stage0/ 4. https://www.gnu.org/software/mes/ https://www.gnu.org/software/mes/
- matheusmoreira 5y ago
  Wish modern hardware had better support for this. I don't think I'll ever trust their proprietary firmwares. The problem is becoming so widespread. All kinds of peripherals have firmware now. Who knows what they're doing. Did that storage device really delete the data or is it just pretending? Only way to be sure is to physically destroy the device.
  - tenebrisalietum 5y ago
    > Only way to be sure is to physically destroy the device. Or ... never write unencrypted data to the device.
    - matheusmoreira 5y ago
      Yeah, that was my solution as well. It's much easier to destroy a small secret key than terabytes of data.
      - kragen 5y ago
        Especially with N-of-M secret sharing.
  - galcerte 5y ago
    I thought something along these lines when it comes to peripherals, too, but don't these (mice and keyboards chiefly) communicate with PCs through a subset of the USB standard which only handles HID and nothing else? Would any snooping be possible through an input device if it only did HID?
    - matheusmoreira 5y ago
      > PCs through a subset of the USB standard which only handles HID and nothing else? Yes. Is the device truly limited to doing just that, though? No way to know. I don't know enough electronics to tear it down and analyze its parts, much less dump firmware and reverse engineer it. >Would any snooping be possible through an input device if it only did HID? For all I know, it could be silently storing every keystroke in some small memory module hidden somewhere.
hyperstar 5y ago
What was the thing that detracted from the corebooted Thinkpad's trustworthiness?
- grae_QED 5y ago
  Libreboot has no binary blobs, Coreboot still has a couple. But modern CPU architectures require some of those blobs to function correctly. So Coreboot has broader compatibility with modern hardware than Libreboot. Both are good, but I've always leaned towards Libreboot just cause I think ThinkPads from 2005-2008 look amazing and it's fun to know that there is no proprietary software on my computer.
  - hyperstar 5y ago
    I flash libreboot first to get rid of the intel management engine and then the latest coreboot to the bios region. I think I configuried it so that it doesn't include any blobs, but I'm not sure. Wish it were easier to tell for non-experts.
- rangerdan 5y ago
  Corebooted Thinkpads are the gold standard. Don't listen to this article - it's utter nonsense - the author even recommend Libreboot which is effectively abandonware barely maintained by one unstable individual.
hyperstar 5y ago
The machines that get 5/5, do they have open hardware? I heard somewhere that there's this thing called microcode that resides in the processor and could contain backdoors. Is that taken into account here?
- tenebrisalietum 5y ago
  It's not. Microcode (insofar as how the term is used for x86/AMD) controls the operation of the CPU itself and the implementation of certain CPU instructions that aren't hardwired. It's too low-level to do things on its own like send a copy of RAM through a network adapter, etc. Nonetheless, if you could manage to reverse engineer the microcode (which is likely different per CPU manufacturer and microarchitecture), and decrypt it (I do know AMD's microcode was not encrypted for a time, but is now), you could probably alter the behavior of some CPU instructions. Maybe you could manipulate some CPU instructions into allowing code to be executed where it wouldn't previously be executed, e.g. ignoring privilege checks, etc. and maybe you could do it without introducing side effects and causing existing code to misbehave or crash. However it's a thousand times easier to modify the actual code the CPU is executing from RAM somehow - through OS vulnerabilities, etc. Any CPU code is either going to be running in kernel mode with full privileges or eventually interacting with code that does through some sort of interface. Operating system code is either available (open source) or widely distributed (Windows). Modern software development is further and further abstracted away from real hardware with ever increasing layers which are also either open source or widely distributed. The possibility for finding human error somewhere in this scheme is vastly more likely to produce useful vulnerabilities - not the CPU microcode which is completely unknown, undocumented, encrypted, changes which each CPU, and updates thereof provided by the manufacturer.
- guerrilla 5y ago
  None of it is open hardware but some of it has been reverse engineered. I know some x86 CPU's have had their microcode reverse engineered, starting with the 8086 but also AMD's K8 and K10. There are lots of die photos of the 486DX chips and a patent says the microcode was pretty small (only 250 "lines", 12kbits.) About the POWER CPUs I have no idea. They're RISC so do they even have microcode?
rangerdan 5y ago
Stopped reading at "Macbook is ... as trustworthy as the Libreboot ThinkPad". Anyone who trusts closed source, proprietary, for-profit platforms from PRISM partners doesn't know what they're talking about.
- ariadneconill 5y ago
  Strictly from a hardware POV. That wasn’t intended to be praise for Apple, but rather an indictment of the industry at large that Apple designed hardware that is easier to extend trust to.
deleted 5y ago
[deleted]
ece 5y ago
How would the HiFive Unmatched stack up here? Seems like it would do rather well: https://starfivetech.com/uploads/hifive-unmatched-sw-reference-manual-v1p0.pdf https://starfivetech.com/uploads/hifive-unmatched-sw-referen... https://sifive.cdn.prismic.io/sifive/28560457-c5a4-4f88-866c-8098d02afea1_FU740-C000-Manual-v1p0.pdf https://sifive.cdn.prismic.io/sifive/28560457-c5a4-4f88-866c...
- ariadneconill 5y ago
  It would, but I don’t have an Unmatched board so I didn’t evaluate it. Same reason why I did not mention the Pine64 stuff: I don’t own any of it.
nimbius 5y ago
conspicuously, infuriatingly absent: https://www.pine64.org/ https://www.pine64.org/ https://puri.sm/ https://puri.sm/
- jonchang 5y ago
  This article appears to be focused on laptops, desktops, and servers, and the author uses the term "system" to collectively refer to these. If this really is "infurating" (and you're not just using the term to be hyperbolic) then I think recognizing that sometimes blog authors write about topics that are more specific or have a different focus than you'd prefer would help calm you down a bit.
  - mepian 5y ago
    The pine64 page has laptops, e.g. https://www.pine64.org/pinebook/ https://www.pine64.org/pinebook/
- ariadneconill 5y ago
  I was only evaluating hardware I actually own. I don’t own any of the PINE64 SBCs or laptops. And while I have a PinePhone, I rarely use it, it sits in my junk drawer basically.
- voltaireodactyl 5y ago
  I’d add the MNT Reform to that list. I’m a huge fan of what they’re doing and hope to get in on the next batch.
joe_the_user 5y ago
What would be a trustworthy motherboard to use to build a solid machine learning system, with a budget of say $5-10K?
- nine_k 5y ago
  A Talos workstation? But the question is moot because GPUs have proprietary firmware, and NVidia drivers that give you CUDA are also closed-source. Maybe air-gapping your sensitive machines is a more viable approach for ML.

112 points by hasheddan 5y ago

ilaksh 5y ago

Weird to me that more people are not working on Redox OS in this context.

guerrilla 5y ago
Why would that be necessary? They can if they want, I'm excited about Redox too, but Linux and the GNU ecosystem is already free software.

blueflow 5y ago

Is the author the same person that talks about Inclusivity, and then posts screencaps of other people they are having disagreements with to twitter, for their followers to sneer at? [1] Is this the same person who uses the departure of a developer as a reason to "fix" a community [2], when the mailmap of one of their projects shows they are referring to their own faked departure? [3] This stuff doesn't make the Alpine Linux project look good. I totally see that its very rude to attack a person like this, but i think its abusive behavior and needs to be called out. [1] https://twitter.com/ariadneconill/status/1445586541040979971 https://twitter.com/ariadneconill/status/1445586541040979971 [2] https://ariadne.space/2021/08/08/on-the-topic-of-community-management-cocs-etc/ https://ariadne.space/2021/08/08/on-the-topic-of-community-m... [3] https://github.com/pkgconf/pkgconf/commit/c7c3ddbfcf67a1b46d16f661c2a16b07b8a6b709 https://github.com/pkgconf/pkgconf/commit/c7c3ddbfcf67a1b46d...

guerrilla 5y ago

It's great to see that more people are still working on this and that people have an interest. If you are interested in this kind of thing, then you'll also want to check out LibreBoot[1] and Bootstrappable Builds[2]. The latter is working with stage0 [3] and mes [4] to bootstrap Guix (among other projects.) All of that is further down the chain, but we'll need it if we want to build trustworthy systems. 1. https://libreboot.org/ https://libreboot.org/ 2. https://www.bootstrappable.org https://www.bootstrappable.org 3. https://github.com/oriansj/stage0/ https://github.com/oriansj/stage0/ 4. https://www.gnu.org/software/mes/ https://www.gnu.org/software/mes/

matheusmoreira 5y ago
Wish modern hardware had better support for this. I don't think I'll ever trust their proprietary firmwares. The problem is becoming so widespread. All kinds of peripherals have firmware now. Who knows what they're doing. Did that storage device really delete the data or is it just pretending? Only way to be sure is to physically destroy the device.
- tenebrisalietum 5y ago
  > Only way to be sure is to physically destroy the device. Or ... never write unencrypted data to the device.
  - matheusmoreira 5y ago
    Yeah, that was my solution as well. It's much easier to destroy a small secret key than terabytes of data.
    - kragen 5y ago
      Especially with N-of-M secret sharing.
- galcerte 5y ago
  I thought something along these lines when it comes to peripherals, too, but don't these (mice and keyboards chiefly) communicate with PCs through a subset of the USB standard which only handles HID and nothing else? Would any snooping be possible through an input device if it only did HID?
  - matheusmoreira 5y ago
    > PCs through a subset of the USB standard which only handles HID and nothing else? Yes. Is the device truly limited to doing just that, though? No way to know. I don't know enough electronics to tear it down and analyze its parts, much less dump firmware and reverse engineer it. >Would any snooping be possible through an input device if it only did HID? For all I know, it could be silently storing every keystroke in some small memory module hidden somewhere.

hyperstar 5y ago

What was the thing that detracted from the corebooted Thinkpad's trustworthiness?

grae_QED 5y ago
Libreboot has no binary blobs, Coreboot still has a couple. But modern CPU architectures require some of those blobs to function correctly. So Coreboot has broader compatibility with modern hardware than Libreboot. Both are good, but I've always leaned towards Libreboot just cause I think ThinkPads from 2005-2008 look amazing and it's fun to know that there is no proprietary software on my computer.
- hyperstar 5y ago
  I flash libreboot first to get rid of the intel management engine and then the latest coreboot to the bios region. I think I configuried it so that it doesn't include any blobs, but I'm not sure. Wish it were easier to tell for non-experts.
rangerdan 5y ago
Corebooted Thinkpads are the gold standard. Don't listen to this article - it's utter nonsense - the author even recommend Libreboot which is effectively abandonware barely maintained by one unstable individual.

hyperstar 5y ago

The machines that get 5/5, do they have open hardware? I heard somewhere that there's this thing called microcode that resides in the processor and could contain backdoors. Is that taken into account here?

tenebrisalietum 5y ago
It's not. Microcode (insofar as how the term is used for x86/AMD) controls the operation of the CPU itself and the implementation of certain CPU instructions that aren't hardwired. It's too low-level to do things on its own like send a copy of RAM through a network adapter, etc. Nonetheless, if you could manage to reverse engineer the microcode (which is likely different per CPU manufacturer and microarchitecture), and decrypt it (I do know AMD's microcode was not encrypted for a time, but is now), you could probably alter the behavior of some CPU instructions. Maybe you could manipulate some CPU instructions into allowing code to be executed where it wouldn't previously be executed, e.g. ignoring privilege checks, etc. and maybe you could do it without introducing side effects and causing existing code to misbehave or crash. However it's a thousand times easier to modify the actual code the CPU is executing from RAM somehow - through OS vulnerabilities, etc. Any CPU code is either going to be running in kernel mode with full privileges or eventually interacting with code that does through some sort of interface. Operating system code is either available (open source) or widely distributed (Windows). Modern software development is further and further abstracted away from real hardware with ever increasing layers which are also either open source or widely distributed. The possibility for finding human error somewhere in this scheme is vastly more likely to produce useful vulnerabilities - not the CPU microcode which is completely unknown, undocumented, encrypted, changes which each CPU, and updates thereof provided by the manufacturer.
guerrilla 5y ago
None of it is open hardware but some of it has been reverse engineered. I know some x86 CPU's have had their microcode reverse engineered, starting with the 8086 but also AMD's K8 and K10. There are lots of die photos of the 486DX chips and a patent says the microcode was pretty small (only 250 "lines", 12kbits.) About the POWER CPUs I have no idea. They're RISC so do they even have microcode?

rangerdan 5y ago

Stopped reading at "Macbook is ... as trustworthy as the Libreboot ThinkPad". Anyone who trusts closed source, proprietary, for-profit platforms from PRISM partners doesn't know what they're talking about.

ariadneconill 5y ago
Strictly from a hardware POV. That wasn’t intended to be praise for Apple, but rather an indictment of the industry at large that Apple designed hardware that is easier to extend trust to.

deleted 5y ago

[deleted]

ece 5y ago

How would the HiFive Unmatched stack up here? Seems like it would do rather well: https://starfivetech.com/uploads/hifive-unmatched-sw-reference-manual-v1p0.pdf https://starfivetech.com/uploads/hifive-unmatched-sw-referen... https://sifive.cdn.prismic.io/sifive/28560457-c5a4-4f88-866c-8098d02afea1_FU740-C000-Manual-v1p0.pdf https://sifive.cdn.prismic.io/sifive/28560457-c5a4-4f88-866c...

ariadneconill 5y ago
It would, but I don’t have an Unmatched board so I didn’t evaluate it. Same reason why I did not mention the Pine64 stuff: I don’t own any of it.

nimbius 5y ago

conspicuously, infuriatingly absent: https://www.pine64.org/ https://www.pine64.org/ https://puri.sm/ https://puri.sm/

jonchang 5y ago
This article appears to be focused on laptops, desktops, and servers, and the author uses the term "system" to collectively refer to these. If this really is "infurating" (and you're not just using the term to be hyperbolic) then I think recognizing that sometimes blog authors write about topics that are more specific or have a different focus than you'd prefer would help calm you down a bit.
- mepian 5y ago
  The pine64 page has laptops, e.g. https://www.pine64.org/pinebook/ https://www.pine64.org/pinebook/
ariadneconill 5y ago
I was only evaluating hardware I actually own. I don’t own any of the PINE64 SBCs or laptops. And while I have a PinePhone, I rarely use it, it sits in my junk drawer basically.
voltaireodactyl 5y ago
I’d add the MNT Reform to that list. I’m a huge fan of what they’re doing and hope to get in on the next batch.

joe_the_user 5y ago

What would be a trustworthy motherboard to use to build a solid machine learning system, with a budget of say $5-10K?

nine_k 5y ago
A Talos workstation? But the question is moot because GPUs have proprietary firmware, and NVidia drivers that give you CUDA are also closed-source. Maybe air-gapping your sensitive machines is a more viable approach for ML.